{"id":"CVE-2026-62124","published":"2026-10-10T20:16:44.540","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/n7-golf-club/vulnerability/wordpress-n7-golf-club-sports-events-theme-2-21-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability allows unauthenticated attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution. This flaw affects N7 | Golf Club Sports & Events plugin versions up to 2.21.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered via a crafted HTTP request to the vulnerable endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, potentially leading to full system compromise and data exfiltration across all golf club events and sports management functionality.","remediation":"Upgrade to version 2.22 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php-injection","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:47:51.165Z"}}