N7 Golf Club Sports & Events theme: Unauthenticated PHP Object Injection
Summary
The N7 | Golf Club Sports & Events WordPress theme up to and including version 2.21 contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on the available PHP classes, code execution. The CVSS score is 9.8 (critical), and Patchstack expects exploitation.
Affected
- N7 | Golf Club Sports & Events theme (WordPress), versions up to and including 2.21
Fixed in
- Unknown. No vendor advisory names a fixed version for this CVE.
- A ThemeForest changelog entry mentions a possible object injection during unserialize in skin handling, but it does not reference this CVE and its version is unconfirmed.
Workaround
- Deactivate and remove the theme if it is not needed.
- Place a web application firewall or virtual patch in front of the site that blocks serialized PHP object data in cookies, POST parameters and URLs. This is a stopgap, not a fix, and should be tuned by a specialist.
- Review logs for unusual requests to the theme's endpoints.
Exploitation
- No known exploitation at the time of the sources checked.
- Not listed in CISA KEV.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS 0.00304 (Vulners).
Our recommendation
- Identify every installation of this theme, including staging and forgotten sites, and confirm the version.
- Remove the theme where it is not needed.
- Where it is needed, apply WAF virtual patching now and monitor logs.
- Contact ThemeREX support to confirm the fixed release, then update as soon as a verified fix is available.
- Monitor the Patchstack entry and the ThemeForest changelog for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- ThemeForest product listing and changelog themeforest.net
- OpenCVE CVE entry app.opencve.io
- Vulners entry vulners.com
- VulDB entry vuldb.com
- Strix CVE mapping www.strix.ai
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:32.
Original description (NVD)
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.