This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: A Code Injection flaw in the 'Holiday class post calendar' plugin.…
🛡️ **Root Cause**: CWE-94 (Code Injection). 🐛 **Flaw**: The plugin fails to sanitize the `contents` parameter when creating cache files. 🧹 **Result**: Untrusted data is executed as code.
Q3Who is affected? (Versions/Components)
🏢 **Vendor**: strix-bubol5. 📦 **Product**: Holiday class post calendar. 📅 **Affected Versions**: Version **7.1 and earlier**. ⚠️ Check your plugin version immediately!
Q4What can hackers do? (Privileges/Data)
👑 **Privileges**: Full system control via RCE. 📂 **Data**: Complete compromise of Confidentiality, Integrity, and Availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 🕵️♂️ No authentication required.
📜 **Public Exp?**: No specific PoC code provided in the data. 🔍 **References**: Links to WordPress Trac and Wordfence exist. ⚠️ High risk of wild exploitation due to low barrier.
Q7How to self-check? (Features/Scanning)
🔍 **Check**: Scan for 'Holiday class post calendar' plugin. 📊 **Version**: Verify if version ≤ 7.1. 🛠️ **Tool**: Use WPScan or manual file inspection on `holiday_class_post_calendar.php` around line 1234.
Q8Is it fixed officially? (Patch/Mitigation)
🛡️ **Fix**: Update to the latest version immediately. 📝 **Patch**: Refer to the WordPress Trac changeset for the fix. 🔗 **Link**: https://plugins.trac.wordpress.org/changeset?…
🚧 **Workaround**: Disable the plugin if not essential. 🚫 **Mitigation**: Remove the plugin entirely if possible. 🛑 **Block**: Restrict access to cache directories if you cannot uninstall.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: CRITICAL. 🚨 **Priority**: P1. 🏃 **Action**: Patch NOW. The CVSS score is High (9.8+ implied by H/I/H), and no auth is needed. Don't wait!