The vulnerability is an unauthenticated PHP Object Injection flaw in the N7 | Golf Club Sports & Events theme for WordPress. It is classified as CWE‑502 and allows an attacker to insert malicious serialized PHP objects into the application. If an attacker successfully supplies a crafted object, the theme’s PHP code can deserialize it, enabling the execution of arbitrary PHP code on the affected WordPress installation. This results in a compromise of confidentiality, integrity, and availability of the site and potentially the underlying server.

The ThemeREX N7 theme for WordPress is the affected product. All releases through version 2.21 are vulnerable; any WordPress site that is running these theme versions is at risk.

The CVSS base score of 9.8 indicates extremely high severity. EPSS data is not available, but the lack of a KEV listing does not reduce the potential impact. The likely attack vector is via unauthenticated HTTP requests that deliver serialized objects to the theme’s processing endpoints; the attacker does not require prior authentication and only needs network access to the web server, making exploitation relatively straightforward for a motivated adversary.