CVE-2025-12813
Published: 11 November 2025
Summary
CVE-2025-12813 is a critical-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-12813 is a Remote Code Execution vulnerability (CWE-94) in the Holiday class post calendar plugin for WordPress, affecting all versions up to and including 7.1. The issue stems from a lack of sanitization of user-supplied data passed via the 'contents' parameter when creating a cache file, allowing arbitrary code execution on the server. Published on 2025-11-11, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables remote code execution on the web server hosting the vulnerable WordPress site, granting high-impact access to confidentiality, integrity, and availability.
Advisories from Wordfence provide detailed threat intelligence on the vulnerability, while the WordPress plugins trac repository offers source code context at line 1234 in holiday_class_post_calendar.php and a specific changeset documenting the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-60947
Vulnerability details
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a…
more
cache file. This makes it possible for unauthenticated attackers to execute code on the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-12813 is an unauthenticated RCE vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access and code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the lack of sanitization of the user-supplied 'contents' parameter by enforcing validation of inputs before creating cache files, preventing arbitrary code execution.
Establishes a risk-based process to identify, prioritize, and remediate the RCE flaw in all versions of the Holiday class post calendar plugin up to 7.1.
Conducts periodic vulnerability scanning to detect the presence of CVE-2025-12813 in WordPress plugins and triggers remediation to prevent exploitation.