YOOtheme Pro: Unauthenticated Remote Code Execution (CVE-2026-102785)

CVE-2026-102785 is a critical unauthenticated remote code execution (RCE) vulnerability affecting the YOOtheme Pro extension for Joomla and theme for WordPress. An exploit PoC has been publicly disclosed that leverages signature reuse, image operation injection, and path traversal to write a JPEG+PHP polyglot file to public media directories. YOOtheme has addressed this in version 5.0.53.

Attack Chain

1. Attacker performs fingerprinting of target websites to identify YOOtheme Pro installations.
2. Attacker identifies a public image URL to obtain a valid signature for the image processing engine.
3. Attacker injects malicious FROMFILE and SAVE image operations into the processing request.
4. Attacker utilizes path traversal to escape the intended image cache directory.
5. Attacker forces the application to write a JPEG+PHP polyglot file into a public-facing media directory.
6. Attacker triggers code execution by requesting the uploaded file, leading to the deployment of a custom PHP uploader.

Impact

Successful exploitation allows for full unauthenticated remote code execution, granting attackers the ability to upload shells, exfiltrate data, or compromise the underlying web server.

Recommendation

• Upgrade YOOtheme Pro to version 5.0.53 or later immediately.
• Implement file integrity monitoring on WordPress/Joomla media and upload directories to detect the creation of unexpected .php or .phtml files.
• Review web server access logs for anomalous requests to image processing endpoints or direct execution of files within media/cache paths.