IT SBIT Services
Schneeberger
DEEN
CVE tracker

YOOtheme Pro: Unauthenticated remote code execution via image transformation handler

CVE-2026-102785Critical 10.0Public exploit

← All vulnerabilities

Summary

The CVE record describes an incomplete binding of image operations and output destination to the request signature in the publicly accessible image transformation handler of YOOtheme Pro 5.0.0 to 5.0.52, as used in the Joomla extension. An unauthenticated attacker can reuse a signature from a public image URL, inject operations, traverse out of the cache directory and write a PNG/PHP polyglot into an executable public media directory, which enables remote code execution. WordPress impact is reported by third parties but not confirmed by the vendor. The CVSS 4.0 base score is 10.0 (critical).

Affected

  • YOOtheme Pro 5.0.0 through 5.0.52 (verified upper bound; some trackers list 5.0.55, not confirmed by the vendor)
  • YOOtheme Pro 4 and earlier: unaffected according to the vendor

Fixed in

  • Update to YOOtheme Pro 5.0.53 (released 21 October 2026)

Workaround

Unknown. The vendor has not published a workaround; updating is the only fix.

  • Third-party compensating controls (they do not fix the flaw): restrict external access to the image handler, disable PHP execution in public media and image cache directories, and tighten write permissions.
  • Test first, as blocking the handler can break image rendering on the site.

Exploitation

  • A public proof-of-concept exploit exists on GitHub; we have not verified it.
  • Security Online reports that Palo Alto Networks Unit 42 confirmed attacks from 26 October 2026, including webshell drops. This is not independently confirmed.
  • No listing as known exploited was found in CISA KEV during our research.

Our recommendation

  • Inventory all YOOtheme Pro installations, including the Joomla template and system plugin entries, which update together.
  • Update all installations on 5.0.0 to 5.0.52 to 5.0.53 immediately.
  • Check upload and media directories for unexpected PHP or image files and review web server logs for requests to the image handler before the update. Treat any hit as a possible compromise: rotate credentials and consider a clean rebuild.
  • Monitor the NVD entry, which was still awaiting analysis at the time of research.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:03.

Original description (NVD)

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed