YOOtheme Pro 5.0.0-5.0.52 – Actively Exploited Unauthenticated File Upload (CVE-2026-102785)
YOOtheme Pro versions 5.0.0 through 5.0.52 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-102785. Wordfence reports blocking 1,002 attacks in a 24-hour period. Update the WordPress theme to version 5.0.53 or later immediately and investigate exposed sites for compromise.
| Product | YOOtheme Pro for WordPress |
|---|---|
| Affected versions | 5.0.0 through 5.0.52 |
| Fixed version | 5.0.53 |
| CVE | CVE-2026-102785 |
| Severity | Critical, CVSS 9.8 |
| Authentication | Not required |
| Attack class | Arbitrary file upload leading to possible remote code execution |
| Exploitation | Active attacks; 1,002 attempts blocked by Wordfence in 24 hours |
How the vulnerability works
The flaw is in YOOtheme Pro’s publicly reachable image transformation handler. The handler does not fully bind normalized image operations and the output destination to the request signature. An unauthenticated attacker can reuse information exposed in a legitimate public image URL, alter image-processing operations, and write an attacker-controlled file outside the intended cache directory.
If the destination is a public directory that executes PHP, the uploaded file can provide remote code execution. Public exploit tooling is available, and Wordfence has observed substantial attack volume, so vulnerable sites should be treated as potentially compromised rather than merely awaiting an update.
Immediate remediation
- Update YOOtheme Pro to version 5.0.53 or later using the official YOOtheme package or licensed updater.
- If the update cannot be completed immediately, take the affected site offline or restrict public access until the theme is patched.
- Review web logs for unusual requests to YOOtheme image-processing routes and follow-up requests to newly created files.
- Inspect WordPress uploads, YOOtheme cache locations, and other writable public directories for unexpected executable or polyglot files.
- Review administrator accounts, active plugins, must-use plugins, scheduled tasks, modified PHP files, and outbound connections.
The official YOOtheme changelog identifies version 5.0.53, released October 21, 2026, as the security update that fixes unauthenticated remote code execution through the image handler.
Verify the installed version
wp theme get yootheme --fields=name,status,version,update,update_version
wp theme list --fields=name,status,version,update --format=table
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp plugin list --status=must-use --fields=name,status,version --format=table
wp cron event list --fields=hook,next_run_gmt,recurrence --format=table
wp core verify-checksumsConfirm the installed theme reports version 5.0.53 or newer. Premium theme updates may require a valid YOOtheme account or a manual installation of the official package.
Indicators to review
- Unusual image-handler requests containing repeated encoding, path manipulation, or unexpected output destinations.
- New PHP, PHTML, or image files with embedded executable content in public media or cache directories.
- Requests to newly created files immediately after image-transformation traffic.
- Unexpected administrators, plugins, must-use plugins, cron hooks, options, or outbound network connections.
Updating closes the vulnerability but does not remove an existing backdoor. Preserve relevant logs and suspicious files for investigation, restore from a known-good backup where appropriate, and rotate WordPress salts, administrator passwords, hosting credentials, database credentials, and API keys if compromise is suspected.
Sources
