Unauthenticated PHP Object Injection in N7 Theme by Patchstack
CVE-2026-62124

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
N7 | Golf Club Sports & Events
Vendor
CVE Published:
10 October 2026

What is CVE-2026-62124?

An unauthenticated PHP Object Injection vulnerability has been identified in the N7 Golf Club Sports & Events theme for WordPress, affecting versions up to 2.21. This flaw allows attackers to manipulate objects when appropriate input is not validated, potentially leading to arbitrary code execution or other malicious activities. Website administrators using the affected theme are advised to review their installations and apply necessary updates to mitigate risks.

Affected Version(s)

N7 | Golf Club Sports & Events <= 2.21

References

https://patchstack.com/database/wordpress/theme/n7-golf-c...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

johska | Patchstack Bug Bounty Program
.