CVE-2026-102785yootheme Unrestricted File Upload
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.55
Published Oct 22, 2026 · Updated Oct 27, 2026 · Also known as EUVD-2026-108161, GHSA-8w8j-f6ph-29mm, WORDFENCE-d928290b-c20c-4ca7-9bbc-7cc67a07ac8a, d928290b-c20c-4ca7-9bbc-7cc67a07ac8a
Key Facts
Patch immediately- CVE-2026-102785 is a critical-severity vulnerability (CVSS 10.0 v4) affecting yootheme (wordpress-theme), YOOtheme Pro extension for Joomla.
- It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Oct 27, 2026. No public exploit code is known.
- EPSS estimates a 0.8% probability of exploitation in the next 30 days.
- Fixed versions are available, including yootheme 5.0.53.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
10.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
EPSS (30-day exploit likelihood)
0.8%
Higher than 55.5% of all scored CVEs
Exploit maturity
Exploited (KEV)
ATLAS score
67/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Oct 27, 2026
5 days after publication
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Exploited (KEV)
Public exploit code
4
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Description
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature.
An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CIRCL KEV | Oct 27, 2026 | n/a | Not reported |
| Industry KEV feed | Oct 27, 2026 | n/a | Not reported |
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| yoothemewordpress-theme | >= 5.0.0 | 5.0.53 |
| YOOtheme Pro extension for Joomla | >= 5.0.0-5.0.52 | n/a |
Patched Releases
yootheme
5.0.53
Timeline
Publicly disclosed
Oct 22, 2026
Added to CIRCL KEV
Oct 27, 2026
Added to Industry KEV feed
Oct 27, 2026
Last updated
Oct 27, 2026
Weakness Type
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
FAQ
Common Questions.
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature.
Affected: yootheme (wordpress-theme) versions >= 5.0.0; YOOtheme Pro extension for Joomla versions >= 5.0.0-5.0.52. The full list is in the CVE brief.
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Oct 27, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including yootheme 5.0.53.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-102785 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo