Joomla sites running YOOtheme Pro 5.0.0 through 5.0.52 should update to version 5.0.53 or later without delay. CVE-2026-102785 is an unauthenticated remote code execution vulnerability in the extension’s public image transformation handler, with an official CVSS 4.0 score of 10.0 CRITICAL.
Administrators of Joomla sites using YOOtheme Pro 5 should treat this as a priority maintenance task. The confirmed issue, CVE-2026-102785, affects a public-facing image-processing feature and does not require an attacker to sign in. Update affected installations to YOOtheme Pro 5.0.53 or later, then perform a focused review for unexpected files and suspicious image-related requests.
Immediate action for affected Joomla sites
The first task is to identify every site that uses YOOtheme Pro 5 and establish its installed version. This should include production sites, staging environments that are publicly reachable, client sites maintained under agency agreements, and less-visible campaign or microsites.
According to the CVE record for CVE-2026-102785, YOOtheme Pro 5 for Joomla versions 5.0.0 through 5.0.52 are affected. The available evidence supports updating to YOOtheme Pro 5.0.53 or later. Do not postpone the update simply because a site has limited traffic: the vulnerable handler is publicly accessible, and the vulnerability does not require prior authentication.
- Inventory all Joomla installations that use YOOtheme Pro 5.
- Prioritise sites on versions 5.0.0 through 5.0.52.
- Create and verify a current backup before making changes.
- Update to YOOtheme Pro 5.0.53 or later as soon as operationally possible.
- Validate the site after updating and perform the post-update checks described below.
YOOtheme Pro 4 is not listed as affected in the CVE record. That is not a reason to leave older software unmanaged; it means only that the confirmed affected range for this specific CVE is YOOtheme Pro 5.0.0–5.0.52.
YOOtheme Pro 5 vulnerability summary
CVE-2026-102785 is an unauthenticated remote code execution vulnerability in the YOOtheme Pro extension for Joomla. The official record identifies the underlying weakness as an improperly bound, publicly accessible image transformation handler. In practical terms, the protection applied to an image request does not fully bind the requested image operations and destination.
An attacker could reuse a signature disclosed in a legitimate public image URL while adding unapproved image operations and changing where output is written. The CVE record states that this can allow traversal outside the intended cache location and the writing of an attacker-controlled PNG/PHP polyglot file into a web-executable public media directory. If such a file is executed by the server, the result can be remote code execution and potentially full site compromise.
This description explains why the issue deserves urgent remediation. It does not require administrators to reproduce the condition, and this advisory intentionally does not provide payloads, endpoint details, or attack instructions. The safe operational response is to patch the extension and review the locations and logs relevant to the affected functionality.
| Extension | CVE | Authentication | Affected versions | Recommended version | CVSS | CISA KEV status |
|---|---|---|---|---|---|---|
| YOOtheme Pro 5 for Joomla | CVE-2026-102785 | None required | 5.0.0 through 5.0.52 | 5.0.53 or later | CVSS 4.0: 10.0, CRITICAL | Not listed at the time of writing |
How to update safely to YOOtheme Pro 5.0.53
Security updates should be prompt, but they should also be controlled. A usable backup and a short validation plan reduce the chance that a necessary patch creates avoidable service disruption. Use the update method appropriate to your YOOtheme Pro licensing and deployment process, and obtain the release from the official YOOtheme source or the vendor-supported update channel.
- Record the current state. Note the installed YOOtheme Pro version, Joomla version, active template configuration, customisations, and any recent site changes.
- Take a restorable backup. Include both site files and the database. Confirm that the backup is complete and that the restoration procedure is understood before proceeding.
- Apply the extension update. Update an affected YOOtheme Pro 5 installation to version 5.0.53 or later using the normal administrative process.
- Clear and rebuild relevant caches carefully. Follow the site’s normal cache-management process so that updated assets and image handling are used consistently.
- Perform functional checks. Review public pages using YOOtheme layouts, images, and media. Check administrator access and the site’s key conversion, registration, or client-service journeys.
- Document completion. For managed sites, record the version installed, time of update, backup reference, validation result, and any follow-up work.
The recommendation of 5.0.53 is based on two aligned pieces of evidence: the CVE record defines 5.0.0–5.0.52 as affected, and the available publisher information identifies 5.0.53 as the release that fixes CVE-2026-102785. No separate vendor advisory URL was available in the reviewed evidence, so administrators should continue to monitor official YOOtheme communications for any further guidance.
Post-update checks and compromise review
Applying the update addresses the known vulnerable versions, but patching alone cannot determine whether a site was previously modified. The CVE concerns the potential creation of a crafted file in a public, executable media location. A proportionate review after the update is therefore sensible, especially for sites that were exposed while running an affected release.
Review public files with care
Inspect public media and cache directories for unexpected executable files, including files with PHP content or unusual combinations of image and executable characteristics. Compare suspicious items against known deployment files, media-library records, backup inventories, and legitimate recent changes. Preserve relevant evidence and involve the hosting provider or a qualified incident-response professional when compromise is suspected; avoid treating a simple deletion as proof that the environment is clean.
Review application and web-server logs
Look for unusual or repeated requests associated with image transformation activity, particularly patterns that differ from normal site traffic or contain unexpected image manipulation parameters. Review the period before patching as well as the immediate period around the update. Correlate findings with file timestamps, access logs, error logs, and deployment records where available.
Protect recovery options
Confirm that backups are current, complete, and tested. If suspicious activity is found, retain a clean restoration point and avoid overwriting useful logs or backups. Resetting credentials, reviewing privileged Joomla accounts, and checking hosting access should be considered as part of a broader incident response when there is credible evidence of unauthorised changes.
If patching cannot be completed immediately, consider temporarily restricting public access to the relevant image transformation capability where this is operationally feasible and does not break essential site functions. This is a temporary risk-reduction measure, not a replacement for installing the update.
What the CVSS score and KEV status mean
The official CVE record assigns CVE-2026-102785 a CVSS 4.0 score of 10.0, CRITICAL. This is explicitly a CVSS 4.0 score; it should not be presented as a CVSS 3.1 score or converted into one. Severity scoring describes the potential impact and characteristics of a vulnerability, while evidence of exploitation answers a separate question: whether authoritative sources have confirmed that attackers are using it.
At the time of writing, CVE-2026-102785 has no entry in the CISA Known Exploited Vulnerabilities catalog. There is also no authoritative confirmation from CISA or NVD that the vulnerability is being actively exploited or used in ransomware campaigns. The absence of such confirmation does not lower the need to patch: an unauthenticated, critical remote-code-execution issue on a public-facing Joomla extension warrants prompt action on its technical risk alone.
The NVD record for CVE-2026-102785 is currently marked Awaiting Analysis. Further NVD analysis or details may be added later. Until then, the Joomla-assigned CVE record is the primary source for the confirmed affected range, vulnerability description, and CVSS 4.0 rating used in this advisory.
Multi-site management for agencies and administrators
For agencies, hosts, and freelancers, this advisory is a reminder that extension inventories must be accurate enough to support rapid filtering by product and version. Searching only the primary site list can miss client subdomains, dormant-but-public properties, staging systems, and independently maintained installations.
Use a central tracking sheet or management system to record each site, its owner, environment, YOOtheme Pro version, patch status, backup status, and validation outcome. Contact site owners with a concise explanation of the confirmed affected range and the planned maintenance window. Avoid making unsupported claims about active attacks; the accurate message is that the affected versions contain a critical unauthenticated RCE vulnerability and should be updated quickly.
- Group sites by installed YOOtheme Pro version and exposure.
- Patch publicly reachable affected sites first.
- Use staging for compatibility testing where it is available, but do not let an extended test cycle delay remediation unnecessarily.
- Apply the same post-update file and log review standards across the portfolio.
- Maintain a dated record of the remediation decision and completion evidence for each client site.
- Monitor Joomla, YOOtheme, CVE, and NVD information for revised advisories or additional mitigations.
The central conclusion is straightforward: if a Joomla site runs YOOtheme Pro 5.0.0 through 5.0.52, update it to 5.0.53 or later, validate the site, and check for signs of unexpected files or abnormal image-processing traffic. That response is justified by the confirmed vulnerability details without assuming exploitation that has not been authoritatively reported.
Add comment