CVE Intelligence
Analysis AI-assisted

CVE-2026-62124: WordPress N7 Golf Club Sports & Events theme up to 2.21 - PHP Object Injection

A critical PHP Object Injection flaw (CWE-502) in the N7 Golf Club Sports & Events WordPress theme can be triggered without authentication, according to the record. The CVSS 3.1 base score is 9.8, and the affected range is up to and including 2.21. No fixed version is listed, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-62124 affects the N7 | Golf Club Sports & Events WordPress theme. The record describes an unauthenticated PHP Object Injection issue in versions up to and including 2.21, classified as CWE-502 (Deserialization of Untrusted Data).

Impact

  • The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
  • Deserialization flaws of this kind can lead to unintended behavior depending on the classes available to the application. The exact impact in this theme is not stated in the record.

Affected products and versions

  • Product: ThemeREX N7 | Golf Club Sports & Events (WordPress theme).
  • Affected range: up to and including 2.21.
  • Fixed version: not listed in the record.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. The EPSS probability is 0.00313 (percentile 0.23037, dated 2026-10-23), and the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • No fixed version is listed in the record. Check the Patchstack entry and the theme vendor for updates.
  • Until a fix is confirmed, consider disabling or replacing the theme on sites where it is installed.
  • Limit public exposure of administrative and theme-related endpoints, keep WordPress core and other components updated, and consider a web application firewall as a compensating control.

Detection guidance

  • Inventory WordPress sites to identify installations of the N7 theme and their version.
  • Review web server and application logs for unusual requests to the theme and unexpected serialized data in request parameters, at a high level.
  • Monitor for unexpected changes to theme files or site configuration.

Limitations of the available information

  • The record does not list a fixed version, specific vulnerable components, or the exact vulnerable entry point.
  • Only the NVD, CVE.org and Patchstack references in the record were consulted. No vendor advisory text was available.
  • The EPSS and SSVC values are provided in the record; their interpretation beyond the stated values is limited.

Frequently asked questions

What is CVE-2026-62124?

It is a critical, unauthenticated PHP Object Injection vulnerability (CWE-502) in the N7 Golf Club Sports & Events WordPress theme, affecting versions up to and including 2.21.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack entry and the theme vendor for updates.

Is this CVE known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.