Critical · published November 11, 2025
🚨 An unauthenticated attacker can execute any code they want on your server, all through a single parameter in the Holiday class post calendar plugin for WordPress! 🔥 Think of this vulnerability as a restaurant where the chef takes orders but never checks if the ingredients are safe — anyone could walk in and demand anything, leading to a disastrous menu! 🍽️ If exploited, an attacker could run malicious code on your server, potentially leading to a complete takeover of the site! This could result in data theft, defacement, or worse — leaving your site vulnerable and your users at risk. 😱
Think of this vulnerability as a restaurant where the chef takes orders but never checks if the ingredients are safe — anyone could walk in and demand anything, leading to a disastrous menu! 🍽️ The Holiday class post calendar plugin allows remote code execution due to the lack of sanitization on the 'contents' parameter when creating a cache file, making it a playground for attackers without any authentication needed.
If exploited, an attacker could run malicious code on your server, potentially leading to a complete takeover of the site! This could result in data theft, defacement, or worse — leaving your site vulnerable and your users at risk. 😱 Immediately update to version 7.2 or later of the Holiday class post calendar plugin to close this critical gap. In addition, review your website's security settings and consider implementing a web application firewall to catch suspicious traffic. 🛡️ You've got this! By taking these steps, you'll secure your WordPress site and keep those attackers at bay! 💪✨