A 10.0 in a Joomla and WordPress template is being exploited by a scanner, with a human operator two minutes behind it

CVE-2026-102785 is an unauthenticated remote code execution flaw in YOOtheme Pro, a commercial template and page builder sold for both Joomla and WordPress. It is scored 10.0 on CVSS v4.0, the top of the scale, and the vector carries both E:A and AU:Y, meaning the scorer recorded the flaw as attacked and as automatable. YOOtheme's changelog fixed it in 5.0.53 on 21 October with a single line: "CVE-2026-102785: Fix unauthenticated remote code execution via image handler."

What the flaw is

The advisory describes a handler that "incompletely binds normalized image operations" to the signature that is supposed to authorise them. Public pages on a site built with the template already carry signed image URLs, so an attacker does not need an account or a password. They take a signature that is already valid, append image operations of their own, walk out of the cache directory and write a file into a public media folder that the server will execute.

Affected versions run from 5.0.0 through 5.0.52. The weakness class is CWE-434, unrestricted upload of a file with a dangerous type, which undersells it slightly: nothing is uploaded in the usual sense. The image pipeline is persuaded to write the file itself.

What Unit 42 watched

Palo Alto Networks published a threat note on 26 October describing exploitation it observed directly, and the timeline in it is the part worth sitting with. The CVE went public on 22 October. Proof-of-concept code was available by the 23rd. The first webshell Unit 42 saw written landed 2 days after the patch shipped.

The activity runs in two stages that do not look like each other. An automated scanner writes a polyglot webshell into the site's uploads folder and validates each drop within seconds, sending a random marker and a command to see what comes back. About 2 minutes later a person arrives, with different addresses and hand-typed commands, uploads an ALFA Team webshell through the first shell's own upload form, writes a helper kit into a folder named ALFA DATA, and tries to install the gsocket remote access tool.

One detail gives the operator away as generic: Unit 42 records Linux commands being run against a Windows server. The tooling was not built for the host it landed on, which is what mass exploitation looks like from the inside. Their traffic was routed through residential proxies on Indonesian mobile carrier networks.

The webshell is a real image

The file written is a valid JPEG with the PHP code sitting in its APP13 metadata segment. That is not decoration. An image that is genuinely an image survives being re-encoded by the very pipeline that is supposed to process it, so a site that resizes or regenerates its media does not quietly destroy the payload.

Unit 42 also notes that the request returns HTTP 500. The server reports an error, and the file is written anyway, which means a log full of server errors is not evidence that nothing happened.

The indicators are specific enough to grep for. Files matching yt followed by 7 hexadecimal characters in the uploads folder, a validation command echoing a marker beginning YTS, a response containing the string WPCONFIG, an ALFA DATA directory, and exploitation traffic from 168.144.251 dot 199.

One site owner says it started before the patch

Peter Martin of db8, a Dutch Joomla support firm, published his own log analysis on 23 October. His account is that his site was exploited at 08:44 on 21 October, that YOOtheme's update became available around 15:00 that day, and that he installed 5.0.53 at 15:11. If his reading of the logs is right, the first use of this flaw against his site preceded the fix by more than 6 hours.

What he found afterwards is the part worth repeating regardless. Roughly 15 webshells and backdoors across several folders, about 5,600 htaccess files dropped on a server running nginx, where they do nothing, a replaced index file serving search-engine spam, and five emptied library files. He concluded from the logs that at least 3 separate groups had been through.

This is one operator's analysis of one site and nobody has independently verified it. It is also the only published first-hand account of a compromise through this flaw that we have found, which is why it is here rather than left out.

The mass-exploit tool is public

A GitHub repository published under the name of the CVE advertises itself as an "Unauthenticated RCE Mass Exploit and WAF Bypass" for versions 5.0.0 through 5.0.52. It is a single Python file. It claims to detect whether a target is Joomla or WordPress by itself, carries several WAF-bypass profiles, verifies code execution before recording a host as exploited, runs bulk scans, and ships a follow-on uploader. The README supplies a search query for an internet-wide scanning service and claims 164,000 live results from it.

It also carries a disclaimer saying the tool is for "educational purposes and authorized security testing only" and that the user must have written permission. A bulk scanner with WAF evasion and a confirmed-target list is not a thing anybody runs with written permission, and the disclaimer does not survive contact with the feature list above it.

What to do

• Update to 5.0.53 or later on every site, Joomla and WordPress both, including the ones you built for somebody else and forgot.
• Updating closes the hole and removes nothing. Search media and upload folders for PHP files that have no business being there, and for files matching the yt pattern above.
• Check access logs back to 21 October rather than to the disclosure date, and search them for FROMFILE and SAVE parameters.
• Count your htaccess files and compare the site index file and robots file against a clean install.
• Block PHP execution in upload directories. That single configuration turns this class of flaw into a failed write.
• If you find a shell, assume the credentials and secrets on that host are gone.

What is not established

• How many sites have been compromised. No count exists and no victim has been named beyond the one operator who wrote about his own.
• Whether exploitation really preceded the patch. That rests on one log analysis.
• Whether the Joomla and WordPress builds are equally exposed. The CVE record names the Joomla extension while the webshells Unit 42 observed landed in WordPress upload folders, and Unit 42's own note mixes the two.
• What the 164,000 figure counts. It is the exploit author's claim about a search for the template, not a count of vulnerable versions.
• Why the flaw is not on CISA's catalogue. Version 2026.10.27 carries no YOOtheme entry, four days after public exploitation was described.