Unit 42 reports YOOtheme Pro flaw exploited for webshells

Palo Alto Networks Unit 42 confirmed exploitation of CVE-2026-102785 in YOOtheme Pro on 26 October. The flaw, rated 10.0 on CVSS 4.0, allows unauthenticated remote code execution on the web server. It affects versions 5.0.0 to 5.0.52; YOOtheme Pro 5.0.53 is the patched release. The vulnerability was made public on 22 October, and proof-of-concept exploits appeared by 23 October.

The flaw is in a public image-transformation handler. According to the CVE record, the handler does not properly bind normalised image operations and the output destination to a request signature. Attackers can reuse a signed image URL from the target site and add operations to write a PNG/PHP polyglot file into an executable public media directory. Unit 42 said code was concealed in image metadata and survived re-encoding.

Its researchers observed automated scanners checking each uploaded file within about three seconds; roughly two minutes later, a human operator uploaded an ALFA Team webshell and attempted to install the gsocket remote-access tool. Although the CVE record concerns the Joomla extension, Unit 42 found webshells in WordPress upload folders.

Unit 42 advises upgrading to YOOtheme Pro 5.0.53 or later and checking for webshells named “yt” followed by seven hexadecimal characters in `wp-content/uploads/`, an `ALFA_DATA` folder and traffic from `168.144.251[.]199`. It says a server with a webshell should be treated as fully compromised because the vulnerability enables remote code execution.