CVE-2025-12813

CRITICAL

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitiza...

Affects 0 products across 3 vendors.

CVSS 3.19.8
EPSS0.9%
Percentile60th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to unsanitized user input in the 'contents' parameter, allowing unauthenticated attackers to execute arbitrary code on the server.

BSID: BS-2025-GLOBAL-231632-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-12813?
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution (RCE) due to unsanitized user input in the 'contents' parameter, allowing unauthenticated attackers to execute arbitrary code on the server.
What is the CVSS score for CVE-2025-12813?
CVE-2025-12813 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2025-12813 actively exploited?
No confirmed active exploitation of CVE-2025-12813 as of 2026-10-23.
How do I remediate CVE-2025-12813?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-12813?
CVE-2025-12813 affects Class; Plugin; Wordpress.
Vulnerability Details
CVE IDCVE-2025-12813
BSIDBS-2025-GLOBAL-231632-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-11-11
Last Modified2026-10-18
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending a malicious request with crafted input to the 'contents' parameter, which is then used to create a cache file without proper sanitization. This leads to the execution of arbitrary code on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Class — —
Plugin — —
Wordpress — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 346 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0c719d0918361a5f4ebeccb389c60e93acf49f89935ca501f452972b10de2d70ffcc4b7b70ac6718da12504a104a971f73509e5ddf18fc80fa56cd58888dcea2
Related CVEs affecting Class
CVE-2025-46337 10.0 ADOdb is a PHP database class library that provides abstractions for performi... CVE-2024-56799 10.0 Simofa is a tool to help automate static website building and deployment. Pri... CVE-2025-70974 10.0 Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a... CVE-2025-54119 10.0 ADOdb is a PHP database class library that provides abstractions for performi... CVE-2026-31235 9.8 The imgaug library thru 0.4.0 contains an insecure deserialization vulnerabil...
View all Class CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →