N7 Golf Club theme CVE-2026-28045
HIGHSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX N7 | Golf Club Sports & Events n7-golf-club allows PHP Local File Inclusion.This issue affects N7 | Golf Club Sports & Events: from n/a through <= 2.16.0.
AnalysisAI
Local File Inclusion in N7 Golf Club WordPress theme through version 2.16.0 allows remote attackers to read arbitrary server files via crafted PHP file path manipulation. Despite CVSS 8.1, exploitation requires specific attack chain complexity (AC:H). EPSS 0.15% indicates minimal active exploitation observed. No CISA KEV listing or public POC identified at time of analysis, suggesting limited attacker interest in this WordPress theme vulnerability.
Technical ContextAI
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly caused by unsanitized user input being passed directly to PHP include(), require(), or similar functions. In WordPress themes, this typically manifests when template loading mechanisms accept arbitrary file paths without proper validation or path traversal protection. The 'PHP Remote File Inclusion' classification in the description appears inaccurate-this is confirmed as Local File Inclusion per Patchstack reference and tags, meaning attackers can only read files already present on the server filesystem, not inject remote PHP code. The N7 Golf Club theme by ThemeREX processes file paths in a manner that permits directory traversal sequences (../) to escape intended template directories and access sensitive files like wp-config.php, /etc/passwd, or other configuration files containing database credentials and authentication tokens.
Affected ProductsAI
WordPress theme N7 Golf Club Sports & Events (also marketed as 'n7-golf-club') by ThemeREX, all versions up to and including 2.16.0. Vulnerability affects default theme installations where file include mechanisms are exposed through theme functionality. Per Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/n7-golf-club/vulnerability/wordpress-n7-golf-club-sports-events-theme-2-16-0-local-file-inclusion-vulnerability, this impacts WordPress sites actively using this theme in production environments. Earlier version baselines unknown-assume all historical versions potentially vulnerable until vendor confirms.
RemediationAI
Upgrade N7 Golf Club theme to version 2.16.1 or later when available-check ThemeForest marketplace or ThemeREX official channels for patched release. Specific fix version not independently confirmed at time of analysis; contact vendor directly via ThemeREX support to verify patched version availability. If immediate upgrade is unavailable, implement compensating controls: (1) Restrict direct web access to theme PHP files via .htaccess rules blocking non-WordPress-core requests to theme directories (trade-off: may break legitimate theme AJAX handlers-test thoroughly); (2) Deploy Web Application Firewall rules detecting directory traversal patterns (../, %2e%2e%2f, encoded variants) in requests to theme endpoints (trade-off: potential false positives on legitimate file browser features); (3) Harden PHP configuration with open_basedir directive restricting file access to WordPress root only (trade-off: may conflict with plugins requiring broader filesystem access). Monitor server logs for suspicious requests containing path traversal sequences targeting wp-content/themes/n7-golf-club/. Full advisory: https://patchstack.com/database/Wordpress/Theme/n7-golf-club/vulnerability/wordpress-n7-golf-club-sports-events-theme-2-16-0-local-file-inclusion-vulnerability
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-98 – PHP Remote File Inclusion
View allShare
External POC / Exploit Code
Leaving vuln.today