{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/yootheme/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yootheme:pro:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102785"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["YOOtheme Pro (\u003c= 5.0.52)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["YOOtheme"],"content_html":"\u003cp\u003eCVE-2026-102785 is a critical unauthenticated remote code execution (RCE) vulnerability affecting the YOOtheme Pro extension for Joomla and theme for WordPress. An exploit PoC has been publicly disclosed that leverages signature reuse, image operation injection, and path traversal to write a JPEG+PHP polyglot file to public media directories. YOOtheme has addressed this in version 5.0.53.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs fingerprinting of target websites to identify YOOtheme Pro installations.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a public image URL to obtain a valid signature for the image processing engine.\u003c/li\u003e\n\u003cli\u003eAttacker injects malicious \u003ccode\u003eFROMFILE\u003c/code\u003e and \u003ccode\u003eSAVE\u003c/code\u003e image operations into the processing request.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes path traversal to escape the intended image cache directory.\u003c/li\u003e\n\u003cli\u003eAttacker forces the application to write a JPEG+PHP polyglot file into a public-facing media directory.\u003c/li\u003e\n\u003cli\u003eAttacker triggers code execution by requesting the uploaded file, leading to the deployment of a custom PHP uploader.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full unauthenticated remote code execution, granting attackers the ability to upload shells, exfiltrate data, or compromise the underlying web server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade YOOtheme Pro to version 5.0.53 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring on WordPress/Joomla media and upload directories to detect the creation of unexpected .php or .phtml files.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to image processing endpoints or direct execution of files within media/cache paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T00:59:58Z","date_published":"2026-10-24T00:59:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-yootheme-rce/","summary":"CVE-2026-102785 is a critical unauthenticated remote code execution vulnerability in YOOtheme Pro (versions \u003c= 5.0.52) that allows attackers to write and execute polyglot files via manipulated image processing operations.","title":"YOOtheme Pro: Unauthenticated Remote Code Execution (CVE-2026-102785)","url":"https://feed.craftedsignal.io/briefs/2026-10-yootheme-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - YOOtheme","version":"https://jsonfeed.org/version/1.1"}