Attack Chain

1. Attacker performs fingerprinting of target websites to identify YOOtheme Pro installations.
2. Attacker identifies a public image URL to obtain a valid signature for the image processing engine.
3. Attacker injects malicious FROMFILE and SAVE image operations into the processing request.
4. Attacker utilizes path traversal to escape the intended image cache directory.
5. Attacker forces the application to write a JPEG+PHP polyglot file into a public-facing media directory.
6. Attacker triggers code execution by requesting the uploaded file, leading to the deployment of a custom PHP uploader.

Impact

Successful exploitation allows for full unauthenticated remote code execution, granting attackers the ability to upload shells, exfiltrate data, or compromise the underlying web server.

Recommendation

• Upgrade YOOtheme Pro to version 5.0.53 or later immediately.
• Implement file integrity monitoring on WordPress/Joomla media and upload directories to detect the creation of unexpected .php or .phtml files.
• Review web server access logs for anomalous requests to image processing endpoints or direct execution of files within media/cache paths.