The vulnerability CVE-2026-28045 affects the ThemeREX N7 | Golf Club Sports & Events plugin up to version 2.16.0. It arises from improper control of filenames used in PHP include or require statements, resulting in a PHP Local File Inclusion vulnerability. This flaw could allow attackers to include unintended local files, potentially leading to arbitrary code execution or information disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability could lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the affected system. This compromises confidentiality, integrity, and availability of the application and underlying system. The high CVSS score (8.1) confirms the significant risk posed by this vulnerability. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin and avoid exposing the affected application to untrusted networks. Monitor official ThemeREX communications for updates and patches.