EUVD-2026-96509
GHSA-pf73-6px2-cj3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site using N7 Golf Club theme
-
DeliverySend crafted serialized PHP object
-
ExploitTrigger insecure unserialize()
-
ExecutionInvoke POP gadget chain
-
ImpactExecute code or access data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against default configurations of any WordPress site running the N7 | Golf Club Sports & Events theme at version 2.21 or earlier - no authentication (PR:N) and no user interaction (UI:N) are required, consistent with the 'Unauthenticated' label in the description. The practical limiting factor is inherent to PHP Object Injection: meaningful impact (code execution, file operations) requires a usable POP gadget chain reachable in the theme, WordPress core, or a co-installed plugin; without such a chain the deserialization may be largely inert. Exploitation is also bounded to sites that actually have this specific niche theme installed and active. |
| Impact | All CVSS signals point to a worst-case profile: CVSS:3.1 base 9.8 with AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker can exploit default installations with low complexity and no user interaction, and C:H/I:H/A:H reflects the full-system compromise typical of PHP Object Injection (CWE-502), which commonly escalates to remote code execution when a usable POP gadget chain is present. However, several key risk amplifiers are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no indication of public POC/exploit code, so there is no evidence of active or at-scale exploitation at this time. No SSVC decision data (exploitation status, automatable, technical impact) was provided. The net picture is a genuinely high-severity, easily-weaponizable vulnerability class whose real-world urgency is tempered by a low-footprint affected product and absence of any exploitation telemetry - treat as high priority to patch where the theme is deployed, but it is not (yet) a confirmed mass-exploitation event. One caveat: PHP Object Injection impact is conditional on gadget availability, so the real-world C/I/A may be lower than 9.8 on installs lacking an exploitable chain - the CVSS score represents the worst case. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a WordPress site running the N7 Golf Club Sports & Events theme (<= 2.21) containing a malicious serialized PHP object to an endpoint that unserializes untrusted input. With a suitable POP gadget chain in the theme, WordPress core, or another installed plugin, deserialization triggers attacker-controlled method calls leading to code execution, file manipulation, or data theft. No public exploit code was identified in the provided data, and no authentication or user interaction is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to remove the attack surface: if the N7 | Golf Club Sports & Events theme is not actively in use, deactivate and delete it from wp-content/themes (this is the most reliable mitigation and carries the trade-off of losing any site design built on it). If the theme must remain, place a reverse proxy or WAF rule in front of the site that inspects request bodies, cookies, and headers for PHP serialization syntax (payloads containing 'O:' or 'a:' object/array markers immediately followed by a class name and length, and base64/URL-encoded equivalents such as 'Tzo' or 'YTo') and blocks or logs those requests - with the caveat that aggressive rules can generate false positives on legitimate plugin traffic. Harden the surrounding environment by ensuring WordPress core and all active plugins are current (a patched gadget chain removes the pivot an attacker needs), restricting file-write permissions, disabling unused plugins that provide exploitable magic methods, and monitoring for unexpected file changes or new admin users as post-exploitation indicators. Since the deserialization endpoint is reachable unauthenticated, also consider temporarily requiring authentication at the web-server layer for the entire site if a maintenance window permits, and track the Patchstack advisory page (https://patchstack.com/database/wordpress/theme/n7-golf-club/vulnerability/wordpress-n7-golf-club-sports-events-theme-2-21-php-object-injection-vulnerability?_s_id=cve) for a fixed theme version before restoring normal exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic PHP Object Injection (CWE-502) in a WordPress theme, meaning the theme passes attacker-controllable input into PHP's unserialize() (directly or indirectly through an insecure deserialization path) rather than restricting the operation to safe formats such as JSON. When untrusted data is deserialized, PHP instantiates whatever classes are named in the payload and automatically invokes their magic methods - __wakeup(), __destruct(), __toString(), __call(), and similar - which is the mechanism a POP (property-oriented programming) gadget chain abuses. An attacker chains these magic methods across classes available in the loaded codebase (the theme itself, WordPress core, and any active plugins) to pivot from object instantiation to dangerous sinks such as file writes, eval/command execution, or arbitrary option updates. The CPE string cpe:2.3:a:themerex:n7_|_golf_club_sports_&_events:* confirms the affected artifact is the ThemeREX-distributed N7 theme across all versions, and the vendor/component mapping (WordPress theme framework with PHP code running server-side) explains why exploitation is entirely network-based and pre-authentication: the vulnerable deserialization entry point is reachable without a WordPress session. The practical ceiling on impact is dictated by the presence of a reachable gadget chain, since PHP object injection without one can be largely inert.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote PHP Object Injection reachable over the network with no user interaction gives AV:N/AC:L/PR:N/UI:N; gadget-driven RCE justifies C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Executive ViewAI
A critical unauthenticated flaw in the ThemeREX 'N7 | Golf Club Sports & Events' WordPress theme (versions 2.21 and earlier) allows any remote attacker to inject a crafted PHP object into a site endpoint without credentials or user interaction, with a worst-case outcome of full site takeover. Only organizations running this specific golf/sports theme are exposed, but for those sites the risk spans complete loss of confidentiality, integrity, and availability of the web property and any data it handles. Because no vendor patch or public exploit code has been identified at this time, leadership should treat remediation as a manual, time-sensitive decision for affected properties.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or replace the vulnerable theme, take affected sites offline or restrict access, block the vulnerable theme endpoint at the WAF/reverse proxy, apply a rule targeting serialized object payloads, remove unused plugins that could supply a POP gadget chain, monitor for anomalous requests and file changes, and rotate credentials and secrets if compromise is suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB