CVE-2026-28045 PUBLISHED

WordPress N7 | Golf Club Sports & Events theme <= 2.16.0 - Local File Inclusion vulnerability

Assigner: Patchstack
Reserved: 25.02.2026 Published: 05.03.2026 Updated: 05.03.2026

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX N7 | Golf Club Sports & Events n7-golf-club allows PHP Local File Inclusion.This issue affects N7 | Golf Club Sports & Events: from n/a through <= 2.16.0.

Product Status

Vendor	ThemeREX
Product	N7 \| Golf Club Sports & Events
Versions	Default: unaffected affected from n/a to <= 2.16.0 (incl.)

Credits

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/Wordpress/Theme/n7-golf-club/vulnerability/wordpress-n7-golf-club-sports-events-theme-2-16-0-local-file-inclusion-vulnerability?_s_id=cve

Problem Types

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE

Impacts

PHP Local File Inclusion