CYBUNKR

YOOtheme Pro flaw lets attackers take over websites without logging in

Published

CVE-2026-102785 in the YOOtheme Pro website builder, rated 10 out of 10, lets anyone plant a webshell through a public image link. Exploit code is public and exploitation attempts are reported. Update to 5.0.53 now.

If your website was built with YOOtheme Pro, a popular premium theme and page builder for Joomla and WordPress, ask for it to be updated today. CVE-2026-102785, rated the maximum 10 out of 10 (CVSS v4.0), lets an attacker write their own PHP file to the site without logging in, by reusing a signed image link that every page publishes (CVE record). That file is a webshell: full control of the site and often of the hosting account.

Who is affected

  • YOOtheme Pro 5.0.0 to 5.0.52. The CVE record, published on 22 October, lists the Joomla extension.
  • WordPress sites too: the researcher who published exploit code says it works against YOOtheme Pro on both WordPress and Joomla.
  • Version 5.0.53 fixes it. The researcher says it was released on 21 October. Premium themes don't always update themselves, so many sites are likely still on an older version.
  • Built by an agency? Many small business sites are. If yours is, the questions below are for them.

What has been seen so far

A snapshot from 29 October:

  • CIRCL's Vulnerability-Lookup has logged exploit code being shared since 24 October, and a working exploit with a detailed write-up is public on GitHub (al4n4n).
  • Threat feed Previdian reports exploitation attempts in the wild with high confidence and added it to its exploited list on 27 October.
  • It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's assessment in the CVE record still rates exploitation as “none”.

Unverified exploit code is sometimes laced with malware, so don't run it to test your own site.

What to do

  • Update YOOtheme Pro to 5.0.53 or later from the Joomla or WordPress admin, or ask your agency to. The researcher knows of no workaround (al4n4n).
  • Check for webshells, even after updating: look for .php files in media, image and upload folders (for example images/ on Joomla or wp-content/uploads/ on WordPress), where PHP files shouldn't be.
  • Stop PHP running in upload folders through your web server or hosting settings, so a dropped file can't run.
  • If you find one, treat the site as compromised: restore from a clean backup, then change admin, database and hosting passwords.

How we can help

If you think your website has been compromised, our Incident Response service can help, or get in touch.

Sources