CVE-2026-102785: Unauthenticated RCE in YOOtheme Pro

YOOtheme Pro is a widely deployed Joomla theme and page builder used across thousands of websites, offering advanced layouts and sophisticated content management. CVE-2026-102785 describes a critical flaw in its publicly accessible image transformation handler. An unauthenticated attacker can intercept and reuse the cryptographic signature present in legitimate public image URLs, inject unintended image operations, circumvent directory restrictions, and write executable files (PNG/PHP polyglots) to web-accessible areas, achieving remote system access.

The vulnerability carries a CVSS score of 10.0, the maximum rating, as it enables unauthenticated RCE without any prerequisites. It was published in NVD on October 22, 2026 and is generating traction in security communities: in the last 24 hours, at least 4 posts on X discuss it with technical consistency (versions and CVSS score correct). However, public exploit availability is not confirmed in official data; social media signals indicate widespread awareness but are not verified sources of active exploitation.

For sysadmins and IT teams: identify all Joomla instances running YOOtheme Pro versions 5.0.0 through 5.0.52 using software inventory and vulnerability scanning tools. The priority action is immediate update to the patched version. If updates are blocked by dependencies or compatibility issues, disable the image transformation module until a patch can be deployed. Consult the official YOOtheme website (yootheme.com) for upgrade instructions and review the version changelog.

After patch deployment, review access logs for anomalous requests to image transformation paths in the preceding days. Scan public directories for suspicious PNG or PHP files created during the vulnerability window. Document all remediation steps for compliance and forensic purposes.