CVE-2026-62124: CWE-502 Deserialization of Untrusted Data in ThemeREX N7 | Golf Club Sports & Events

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists in ThemeREX's N7 | Golf Club Sports & Events plugin for WordPress. Versions up to and including 2.21 are affected. The flaw allows unauthenticated attackers to inject malicious PHP objects via deserialization, which can lead to remote code execution and full compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation can result in complete system compromise including full confidentiality, integrity, and availability loss. Because the vulnerability is unauthenticated and remotely exploitable, attackers can execute arbitrary code and control the affected system without any prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor ThemeREX advisories for updates. Until a fix is available, consider disabling or restricting access to the affected plugin to mitigate risk.