The vulnerability CVE-2026-28045 in ThemeREX N7 | Golf Club Sports & Events arises from improper control of filenames in PHP include/require statements, enabling PHP Local File Inclusion. This allows an attacker to include local files on the server, which can lead to disclosure of sensitive information or remote code execution depending on the context. The affected versions are from initial releases through 2.16.0. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Successful exploitation of this vulnerability can lead to local file inclusion, which may disclose sensitive server files or enable remote code execution, severely impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 reflects a high impact with network-based exploitation possible without privileges or user interaction, though with high attack complexity. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor ThemeREX communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin and applying web application firewall rules to block suspicious requests targeting file inclusion. Avoid exposing the affected plugin to untrusted users or networks.