YOOtheme Pro: Critical 10/10 Vulnerability in a Popular Website Builder. What to Do

If your Joomla or WordPress website uses YOOtheme Pro 5, check it today. A vulnerability identified as CVE-2026-102785 has been discovered in the website builder, with the maximum severity score of 10 out of 10. It allows anyone to upload malicious code to your website and take control of it. No username or password required.

A fix was released on October 21 in version 5.0.53. However, the first attacks occurred that same morning, several hours before the update became available. Publicly available tools for exploiting the vulnerability are already circulating online.

That's why updating alone isn't enough. You also need to check whether your website has already been compromised. Here's how.

What Is YOOtheme Pro?

YOOtheme Pro is a website builder for Joomla and WordPress. It lets you create websites using ready-made blocks, much like building a house with LEGO bricks: drag and drop a heading, a gallery, or a form, and your page is ready. No coding required.

That's why it's popular among web agencies and small website owners. According to publicly available data, more than 160,000 websites worldwide use YOOtheme Pro.

What Happened?

YOOtheme Pro can automatically process images: resize, crop, and rotate them. It stores the processed copies in a dedicated folder. To prevent unauthorized requests, each image URL includes a "signature." Think of it as a stamp on an order form at a photo studio.

The problem was that the signature wasn't fully verified. An attacker could take a signature from any publicly accessible image on the website and add their own instructions to the request. For example: "Save this file somewhere other than the images folder." The system recognized the familiar signature and followed the instructions.

As a result, an attacker could upload a file that appeared to be an image but actually contained executable code. This allowed them to gain full control over the website.

Timeline:

Who Is Affected?

Important: The official vulnerability record only mentions Joomla. However, the WordPress version uses the same code. Researchers have identified compromised websites running on both platforms.

There is no temporary workaround. The only way to protect your website from this vulnerability is to update to version 5.0.53 or later.

Step 1. Check Your Version

Joomla. Log in to the admin panel and go to System → Manage → Extensions. Search for YOOtheme. You'll see the version number next to the extension.

WordPress. Go to Appearance → Themes and click the YOOtheme theme. The version number is shown in its description.

Via SSH. Navigate to your website directory and run one of the following commands.

For WordPress:

grep -m1 "Version" wp-content/themes/yootheme/style.css

For Joomla:

grep -m1 "<version>" templates/yootheme/templateDetails.xml

If you're running version 5.0.0 through 5.0.52, proceed to Step 2. If you already have version 5.0.53 or later, you should still complete Step 3.

Step 2. Update YOOtheme Pro

Before updating, create a backup of your website files and database. If something goes wrong, you'll be able to restore your website from the backup.

Joomla. Go to System → Update → Extensions. Find YOOtheme Pro and click Update.

WordPress. Go to Dashboard → Updates. Find the YOOtheme theme and update it.

If the update doesn't appear. Automatic updates require a valid license key (API key) in the YOOtheme settings. If you don't have one configured, download the latest version from your account on the YOOtheme website and install it manually, just like any other extension or theme.

After updating, check the version again as described in Step 1. It should be 5.0.53 or later. Open your website and make sure the pages and images still look and work as expected.

Step 3. Check Whether Your Website Has Been Compromised

Updating closes the vulnerability, but it doesn't remove anything an attacker may have already left behind. It's like changing your locks after someone steals your keys. If the thief already entered your home and hid a spare key in a cupboard, changing the lock won't solve the problem.

In known attacks, hackers placed malicious files in upload directories. These folders normally contain images and documents. PHP files generally shouldn't be there.

For WordPress:

find wp-content/uploads -type f -name "*.php"

For Joomla:

find images -type f \( -name "*.php" -o -name "php.ini" \)

For both platforms. Check PHP files modified after October 20:

find . -type f -name "*.php" -newermt "2026-10-20" | head -50

If you haven't updated your website during this period but some PHP files have changed, that's a reason to investigate.

If you find suspicious files:

1. Temporarily take your website offline.

2. Restore a backup from October 20 or earlier. Restore it into a completely empty directory so no malicious files are left behind.

3. Immediately update YOOtheme Pro and all other extensions. The backup will still contain the vulnerable version.

4. Change administrator, database, and FTP passwords.

5. Only then bring your website back online.

Checklist

• Checked my YOOtheme Pro version

• Backed up the website files and database

• Updated YOOtheme Pro to version 5.0.53 or later

• Confirmed the website still looks and works correctly

• Searched for PHP files in upload directories

• Checked PHP files modified after October 20

• If signs of compromise were found, restored a clean backup and changed passwords

Don't Want to Handle It Yourself?

Updating a theme is straightforward. Finding a hidden malicious program is much harder. Attackers can disguise it as an image or hide it among thousands of website files. Restoring a website from a backup without losing important data also requires care.

Zomro offers two options for situations like this.

SOD: We'll Check and Clean Your Website

Our system administrator will:

• check your YOOtheme Pro version and update it;

• search for malicious files and signs of compromise;

• restore your website from a clean backup if necessary;

• help you change passwords and close unnecessary access points.

Price: €12.50 per 15 minutes of work.

Order a Website Security Check

Premium: Fast Support When You Need It

If your website has been compromised, every hour gives attackers more time. With standard technical support, a response may take up to 10 hours. With Premium, we respond within 5 to 30 minutes.

New vulnerabilities appear every week. With Premium, you don't have to deal with them on your own.

Get Premium Support