YOOtheme Pro 5.0.53 fixes an unauthenticated remote code execution flaw in the page builder's public image handler. The CVE record scores it 10.0 on CVSS 4.0, the maximum, and already marks exploit maturity as attacked.
What happened
The handler that resizes and caches images is reachable by anyone who loads a page on the site. In 5.0.52 and earlier it accepted more image operations than it should have, and it did not tie the cache file it writes to the signed URL that authorised the request.
An attacker can therefore take a signature already published in an ordinary image URL, append extra operations, and push the write outside the cache directory. The CVE record describes the result as an attacker-controlled PNG/PHP polyglot landing in an executable public media directory.
Who is affected
Every site running YOOtheme Pro 5.0.0 through 5.0.52. YOOtheme publishes one changelog for the Joomla and WordPress editions, so both need the update.
- Joomla sites running YOOtheme Pro 5.0.x, which installs as both a template and a system plugin
- WordPress sites running YOOtheme Pro 5.0.x
- YOOtheme Pro 4 and earlier, which the vendor says are not affected
What to do now
Update every YOOtheme Pro 5 site to 5.0.53 or later, then check that site for files you did not put there. There is no partial mitigation, so the version upgrade is the fix.
- Confirm the version in the admin, not from a shell: Joomla System, Manage, Extensions, or WordPress Plugins
- Take a backup of each affected site before updating, so you hold a record of what it looked like
- After updating, look for unexpected PHP files sitting in image, cache and media folders
- Treat any site that stayed on 5.0.52 while reachable as suspect until it has been reviewed
What this means for South African businesses
A page builder is exactly the class of component that never appears on a patching schedule, yet it sits in the public web root and needs no login to reach. Most SMEs running Joomla or WordPress hold no inventory of template and plugin versions, so nobody notices the theme is several releases behind. The realistic risk is not a targeted attack but automated scanning that finds an outdated YOOtheme Pro install on a marketing site nobody watches between redesigns.
The flaw is tracked as CVE-2026-102785, and the vendor notice is in the YOOtheme support answer on the image handler fix.