The Holiday class post calendar plugin for WordPress is vulnerable to remote code execution in all versions up to 7.1. An unauthenticated attacker can supply malicious code through the 'contents' parameter when a cache file is created, because the plugin does not sanitize user input. This is a classic code injection flaw (CWE-94) that gives the attacker full control over the server.

Affected systems include any WordPress site running the Holiday class post calendar plugin version 7.1 or earlier. The plugin is distributed by Strix-Bubol5. Sites that have not upgraded beyond version 7.1 are at risk. The vulnerability is independent of user authentication and can be triggered from any public endpoint that accepts the 'contents' parameter.

The CVSS score of 9.8 marks it as critical, but the EPSS score is under 1%, indicating that widespread exploitation has not been observed. The attack can be performed without prior access, simply by sending a crafted request to the plugin’s cache creation endpoint, making the risk high for exposed sites. The vulnerability is not listed in CISA KEV, but the high severity warrants immediate attention.