YOOtheme Pro: unauthenticated remote code execution (CVE-2026-102785) fixed in 5.0.53, reported exploited
Published 01/11/2026 01:54
Timeline
3 events over 6 d
- 26/10/2026First report+1 d
- 27/10/2026CorroboratedVulnCheck KEV+5 d
- 01/11/2026 01:54Published on WatchtowerPro CISO
In short
YOOtheme Pro 5.0.0 to 5.0.52, for Joomla and WordPress, has an unauthenticated remote code execution flaw in its public image handler, fixed in 5.0.53 (released 21/10/2026). The handler does not fully tie the image operations and output location to the request signature. GreyNoise reports a public exploit for CVE-2026-102785 (01/11/2026).
How bad is it
Critical. An attacker who can reach a site running a vulnerable YOOtheme Pro can run their own code on the web server, without logging in.
No exploitation reported yet.
Severity score
CVSS 4.0 from NVD, from joomla.org, read 01/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- YOOtheme Pro 5.0.0 to 5.0.52, as a Joomla extension and as a WordPress theme (unauthenticated remote code execution)
- The affected component is the publicly accessible image handler
Fixed in
- 5.0 branch: 5.0.53
What to do now
- Update YOOtheme Pro to 5.0.53 or later on every Joomla and WordPress site.
- Interim measures reduce exposure and do not make a site safe. Only the update fixes the flaw. If you cannot update at once, ask your hosting provider to disable PHP execution in upload and media directories such as wp-content/uploads.
- Ask your hosting provider to block requests to the image handler that contain the parameters FromFile or Save.
- Updating does not remove an existing webshell. Check upload directories for .php, .phtml or .phar files, for yt<hex>.php files and for an ALFA_DATA directory.
- Treat any site that ran 5.0.0 to 5.0.52 since 21/10/2026 as possibly compromised until checked.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 2 sources with their dates. And technology matching: which of your systems run YOOtheme Pro, at which version, fixed or not - and what each one needs.
Main sources
Known exploited (VulnCheck KEV): yootheme.com YOOtheme Pro extension for Joomla - Unrestricted Upload of File with Dangerous Type Research · YOOtheme Pro Changelog Research