---
title: 'YOOtheme Pro: Critical Vulnerability 10/10 | Zomro'
description: 'Critical YOOtheme Pro 5 vulnerability CVE-2026-102785 (10/10). See which Joomla and WordPress sites are affected, how to update to 5.0.53 and check for hacks.'
image: 'https://cdn.zomro.com/uploads/blog/a48%40server-panel.net/2026/11/03/gemini_generated_image_iueiipiueiipiuei_q50.jpg'
---

![opened image]()

  * [Zomro](https://zomro.com/)
  * [Useful articles](https://zomro.com/blog/articles/)
  * [Hosting security](https://zomro.com/blog/articles/bezopasnost/)
  * YOOtheme Pro: Critical 10/10 Vulnerability in a Popular Website Builder. What to Do 



# YOOtheme Pro: Critical 10/10 Vulnerability in a Popular Website Builder. What to Do

03-11-2026

![](https://cdn.zomro.com/uploads/blog/a48%40server-panel.net/2026/11/03/gemini_generated_image_iueiipiueiipiuei_q50.jpg)

If your Joomla or WordPress website uses YOOtheme Pro 5, check it today. A vulnerability identified as CVE-2026-102785 has been discovered in the website builder, with the maximum severity score of 10 out of 10. It allows anyone to upload malicious code to your website and take control of it. No username or password required.

A fix was released on October 21 in version 5.0.53. However, the first attacks occurred that same morning, several hours before the update became available. Publicly available tools for exploiting the vulnerability are already circulating online.

That's why updating alone isn't enough. You also need to check whether your website has already been compromised. Here's how.

## 

## 

## What Is YOOtheme Pro?

YOOtheme Pro is a website builder for Joomla and WordPress. It lets you create websites using ready-made blocks, much like building a house with LEGO bricks: drag and drop a heading, a gallery, or a form, and your page is ready. No coding required.

That's why it's popular among web agencies and small website owners. According to publicly available data, more than 160,000 websites worldwide use YOOtheme Pro.

## 

## 

## What Happened?

YOOtheme Pro can automatically process images: resize, crop, and rotate them. It stores the processed copies in a dedicated folder. To prevent unauthorized requests, each image URL includes a "signature." Think of it as a stamp on an order form at a photo studio.

The problem was that the signature wasn't fully verified. An attacker could take a signature from any publicly accessible image on the website and add their own instructions to the request. For example: "Save this file somewhere other than the images folder." The system recognized the familiar signature and followed the instructions.

As a result, an attacker could upload a file that appeared to be an image but actually contained executable code. This allowed them to gain full control over the website.

**Timeline:**

Date |  Event  
---|---  
October 26 |  Palo Alto Unit 42 confirmed attacks against websites  
October 23 |  Bots began uploading malicious programs to websites on a large scale  
October 22 |  The vulnerability received a CVE identifier and a severity score of 10/10   
October 21, around 15:00  |  Patched version 5.0.53 was released  
October 21, 08:44 |  First known website compromise, before the patch was released  
October 20 |  YOOtheme issued an urgent update warning  
  
## 

## 

## Who Is Affected?

Your version |  At risk?  
---|---  
YOOtheme Pro 5.0.0–5.0.52 on Joomla |  **Yes**  
YOOtheme Pro 5.0.0–5.0.52 on WordPress  |  **Yes**  
YOOtheme Pro 5.0.53 or later |  No, but check whether your website was compromised before updating  
YOOtheme Pro 4 and earlier |  No, this specific vulnerability does not affect these versions  
  
> **Important** : The official vulnerability record only mentions Joomla. However, the WordPress version uses the same code. Researchers have identified compromised websites running on both platforms.
> 
> **There is no temporary workaround**. The only way to protect your website from this vulnerability is to update to version 5.0.53 or later.

## 

## 

## Step 1. Check Your Version

**Joomla.** Log in to the admin panel and go to **System → Manage → Extensions**. Search for YOOtheme. You'll see the version number next to the extension.

**WordPress.** Go to **Appearance → Themes** and click the YOOtheme theme. The version number is shown in its description.

**Via SSH.** Navigate to your website directory and run one of the following commands.

For WordPress:
    
    
    grep -m1 "Version" wp-content/themes/yootheme/style.css

For Joomla:
    
    
    grep -m1 "<version>" templates/yootheme/templateDetails.xml

If you're running version 5.0.0 through 5.0.52, proceed to Step 2. If you already have version 5.0.53 or later, you should still complete Step 3.

## 

## Step 2. Update YOOtheme Pro

> Before updating, create a backup of your website files and database. If something goes wrong, you'll be able to restore your website from the backup.

**Joomla.** Go to **System → Update → Extensions**. Find YOOtheme Pro and click **Update**.

**WordPress.** Go to **Dashboard → Updates**. Find the YOOtheme theme and update it.

**If the update doesn't appear.** Automatic updates require a valid license key (API key) in the YOOtheme settings. If you don't have one configured, download the latest version from your account on the YOOtheme website and install it manually, just like any other extension or theme.

After updating, check the version again as described in Step 1. It should be 5.0.53 or later. Open your website and make sure the pages and images still look and work as expected.

## 

## 

## Step 3. Check Whether Your Website Has Been Compromised

> **Updating closes the vulnerability, but it doesn't remove anything an attacker may have already left behind.** It's like changing your locks after someone steals your keys. If the thief already entered your home and hid a spare key in a cupboard, changing the lock won't solve the problem.

In known attacks, hackers placed malicious files in upload directories. These folders normally contain images and documents. PHP files generally shouldn't be there.

**For WordPress:**
    
    
    find wp-content/uploads -type f -name "*.php"

**For Joomla:**
    
    
    find images -type f \( -name "*.php" -o -name "php.ini" \)

**For both platforms.** Check PHP files modified after October 20:
    
    
    find . -type f -name "*.php" -newermt "2026-10-20" | head -50

If you haven't updated your website during this period but some PHP files have changed, that's a reason to investigate.

**If you find suspicious files:**

  1. Temporarily take your website offline.

  2. Restore a backup from October 20 or earlier. Restore it into a completely empty directory so no malicious files are left behind.

  3. Immediately update YOOtheme Pro and all other extensions. The backup will still contain the vulnerable version.

  4. Change administrator, database, and FTP passwords.

  5. Only then bring your website back online.




## 

## Checklist

  * Checked my YOOtheme Pro version

  * Backed up the website files and database

  * Updated YOOtheme Pro to version 5.0.53 or later

  * Confirmed the website still looks and works correctly

  * Searched for PHP files in upload directories

  * Checked PHP files modified after October 20

  * If signs of compromise were found, restored a clean backup and changed passwords




## 

## 

## Don't Want to Handle It Yourself?

Updating a theme is straightforward. Finding a hidden malicious program is much harder. Attackers can disguise it as an image or hide it among thousands of website files. Restoring a website from a backup without losing important data also requires care.

Zomro offers two options for situations like this.

### **SOD: We'll Check and Clean Your Website**

Our system administrator will:

  * check your YOOtheme Pro version and update it;

  * search for malicious files and signs of compromise;

  * restore your website from a clean backup if necessary;

  * help you change passwords and close unnecessary access points.




**Price:** €12.50 per 15 minutes of work.

[**Order a Website Security Check**](https://zomro.com/paid-support-services/server-management-services)

### **Premium: Fast Support When You Need It**

If your website has been compromised, every hour gives attackers more time. With standard technical support, a response may take up to 10 hours. With Premium, we respond within 5 to 30 minutes.

New vulnerabilities appear every week. With Premium, you don't have to deal with them on your own.

[**Get Premium Support**](https://zomro.com/paid-support-services)

Similar articles:

[VPS Security Checklist: October 2026](https://zomro.com/blog/articles/751-vps-security-checklist-october-2026) [Security on a cloud VPS: how to protect the server from attacks](https://zomro.com/blog/articles/541-security-on-cloud-vps-how-to-protect-the-server-from-attacks) [Creating a strong and secure password](https://zomro.com/blog/articles/27-sozdaem-nadezhnyy-i-bezopasnyy-parol) [The Certificate Key Turned Out to Be the Number 4: What to Update on Your Server](https://zomro.com/blog/articles/748-the-certificate-key-turned-out-to-be-the-number-4-what-needs-to-be-updated-on-the-server) [Node.js and Next.js: Two Critical Vulnerabilities in One Week and How to Protect Your Website](https://zomro.com/blog/articles/749-nodejs-and-nextjs-two-critical-vulnerabilities-in-one-week-and-how-to-protect-your-website)

[ GPU server from €174.80/mon ](/dedicated-servers/type=gpu)