External risk intelligence

WordPress Holiday Class Post Calendar Plugin Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12813

The vulnerability exists in a WordPress plugin. WordPress sites are typically deployed as public-facing web applications, making this plugin and its functionality reachable by any remote user accessing the website.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin that allows for remote code execution. This means attackers could potentially run unauthorized commands on servers hosting the affected plugin, posing a significant security risk to any organization utilizing this software. The main concern is confirming relevance and exposure.

Attackers can run commands on servers.
Critical vulnerability impacts WordPress plugins.
Confirm plugin relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data to a WordPress site using the Holiday class post calendar plugin. The plugin's `contents` parameter does not properly sanitize this data before creating a cache file, which can lead to the execution of arbitrary code on the server. This could allow an unauthenticated attacker to compromise the website.

Unauthenticated access to the website.
Submitting malicious data via the `contents` parameter.
Remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on the server when the 'contents' parameter is improperly handled, potentially impacting website integrity and functionality.

Server-side code execution.
Via network without authentication.
Compromise of website functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Holiday class post calendar plugin's remote code execution vulnerability requires immediate attention from teams managing WordPress environments. The first practical step is to identify all WordPress instances utilizing this plugin, confirm their internet reachability and business criticality, and then assign ownership for remediation. This process should prioritize critical assets and consider vendor coordination for applying necessary updates.

WordPress administrators should own the issue.
Verify plugin usage and asset criticality.
Plan and execute vendor-coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Holiday class post calendar plugin?

It is an add-on for WordPress websites designed to help manage and display academic or event schedules. Like other WordPress plugins, it extends the core functionality of a site to provide specific administrative or front-end features for users. When installed, it integrates directly into the WordPress file system and server environment to handle its specific task of tracking and rendering calendar data for visitors.

What does CWE-94 mean in the context of CVE-2025-12813?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In plain English, the plugin fails to clean up input provided by a user before using that data to build a file. Because the software treats this external data as if it were valid programming instructions, an attacker can trick the server into running unauthorized commands instead of just saving the calendar information as intended.

How is this Remote Code Execution triggered?

The flaw is triggered when an attacker sends malicious data to the plugin's 'contents' parameter. The plugin takes this input and saves it into a cache file on the server. If the input contains executable code, the server will run it when that cache file is accessed. Simply browsing the website or using standard calendar features without injecting specific, crafted data does not trigger this vulnerability.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is considered a high-priority concern because WordPress plugins are typically deployed on public-facing websites. If your server is reachable over the internet, an attacker can access the affected plugin remotely without needing a login or any special permissions to attempt to execute code on your infrastructure.

What should I do if I use this WordPress plugin?

Your first step is to perform an inventory of your WordPress installations to see if this specific plugin is active. Once identified, you should treat it as a high-priority item, verify the plugin's business necessity, and coordinate with your team to apply any available updates from the vendor. If an update is not immediately available, consider disabling or removing the plugin until a secure version can be installed.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.