YOOtheme Pro Vulnerability CVE-2026-102785 (CVSS 10) Exploited for Remote Code Execution
Do Son 
TL;DR
Attackers are exploiting CVE-2026-102785, a YOOtheme Pro vulnerability that scores the maximum 10.0 on CVSS 4.0. Palo Alto Networks Unit 42 confirmed in-the-wild attacks on October 26. The flaw gives unauthenticated attackers remote code execution on the web server.
A flaw in YOOtheme Pro’s image handler lets anyone write a PHP webshell to a public folder. Automated scanners began dropping webshells two days after the patch shipped. Update to YOOtheme Pro 5.0.53 now.
- CVE: CVE-2026-102785
- CVSS: 10 (Critical · CVSSv4)
- Product: yootheme.com YOOtheme Pro extension for Joomla
- Affected: 5.0.0-5.0.52
- Impact: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
- Status: Exploited in the wild
- EPSS: 0.7% (30-day)
- Action: See vendor advisory
Why It Matters
The attack needs no login and no user action. Moreover, the CVE record marks the flaw as “Automatable.” That makes mass scanning easy.
The timeline also moved fast. The CVE went public on October 22. According to Unit 42, proof-of-concept exploits appeared by October 23.
How the Attack Works
The YOOtheme Pro vulnerability sits in a public image transformation handler. The CVE record says the image handler “incompletely binds normalized image operations and the output destination to its request signature.” As a result, an attacker can reuse a signed image URL from the target site and add extra operations.
The attacker then writes “an attacker-controlled PNG/PHP polyglot to an executable public media directory.” Unit 42 found the code hidden in image metadata, so it survives re-encoding.
What Unit 42 observed
Each drop was checked by a scanner within about three seconds. Roughly two minutes later, a human operator uploaded an ALFA Team webshell. The operator also tried to install the gsocket remote access tool.
Affected Versions
This YOOtheme Pro vulnerability affects versions 5.0.0 through 5.0.52. The CVE record lists the Joomla extension. However, the webshells Unit 42 observed landed in WordPress upload folders.
Patch and Mitigation
First, upgrade to YOOtheme Pro 5.0.53 or later. Next, hunt for signs of compromise. Unit 42 lists webshells named yt plus seven hex characters in wp-content/uploads/, an ALFA_DATA folder, and traffic from 168.144.251[.]199.
The full indicator list is in the Unit 42 threat brief on CVE-2026-102785 exploitation. If you find a webshell, treat the server as fully compromised, since the flaw grants remote code execution.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
