Attackers drop webshells through YOOtheme Pro flaw CVE-2026-102785

Attackers drop webshells through YOOtheme Pro flaw CVE-2026-102785

5 November 2026: Attackers are exploiting CVE-2026-102785, an unauthenticated remote code execution flaw in the image handler of YOOtheme Pro, the website builder for WordPress and Joomla, to write PHP webshells into the uploads folder. YOOtheme fixed it in version 5.0.53 on 21 October. Every release from 5.0.0 to 5.0.52 is affected, and the GitHub advisory rates it critical at 10.0.

Not yet independently verified. The exploitation details rest on one research team's published note; we have not read a count of affected sites from YOOtheme or any other party. The GitHub advisory's publication date was not shown on the page we read. We will update this when it can be confirmed, and remove this note.

Palo Alto Networks' Unit 42 team says the first webshell it saw was written two days after the patch shipped, and that proof-of-concept code was public from 23 October. Japan's JPCERT/CC listed the flaw in its weekly report on 5 November, noting the attacks Palo Alto Networks had confirmed.

How a picture becomes a shell

YOOtheme Pro resizes and caches images through signed URLs. According to Unit 42, the attacker takes a signed image URL the target site has already published and appends extra image operations: one loads the body of the HTTP request as the image source, another saves the result to wp-content/uploads with a .php name. The server answers with an HTTP 500 error, but the file is written.

The dropped file is a valid JPEG with PHP code hidden in its APP13 metadata segment, which survives re-encoding. Unit 42's note gives the request pattern as a call to index.php with a yootheme cache parameter, an existing image, an eight-character hash and the operations FromFile=php://input and Save=wp-content/uploads/... .

Automated first, then a person

The first wave was a scanner. It wrote each webshell, then within about three seconds ran an echo command with a random marker, followed by id, to confirm it worked. About two minutes after one such drop, an operator using different IP addresses uploaded a second, fuller webshell from the ALFA Team family. The operator ran Linux reconnaissance commands on a Windows server, which Unit 42 reads as generic tooling aimed at WordPress hosts in general.

The first-stage shell needs no password. It runs whatever is passed in its c parameter, offers a file upload form, and prints the string WPCONFIG on every request.

What to look for on a site that ran 5.0.52 or older

Updating to 5.0.53 or later closes the hole but removes nothing an attacker has already written. On any site that ran an affected version after 21 October:

• look in wp-content/uploads for PHP files, and in particular names matching yt followed by seven hexadecimal characters and .php;
• search the web server logs for requests to index.php carrying both FromFile=php://input and Save= parameters, including ones that returned 500;
• treat a hit as a full compromise: rotate database and administrator credentials, since the shell is built to read wp-config.

Agencies that build client sites on YOOtheme Pro carry the job for every site they host, because a theme licence on each site does not mean each site updates on its own. YOOtheme GmbH is based in Hamburg. Our website builder software category lists 20 products.

Company profile on TrustList: YOOtheme

Related on TrustList:

• Drupal Commerce access bypass is exploited; update to 3.3.13
• WordPress update race flaw CVE-2026-119977 is now being exploited
• TeamUpdraft breach exposes UpdraftCentral keys that can command WordPress sites

Sources

• YOOtheme: YOOtheme Pro changelog, 5.0.53 of 21 October 2026, 21 October 2026
• Palo Alto Networks Unit 42: YOOtheme Pro CVE-2026-102785 Exploited to Deploy Webshells (timely threat intel), 26 October 2026
• GitHub Advisory Database: GHSA-8w8j-f6ph-29mm (CVE-2026-102785), 5 November 2026
• JPCERT/CC: Weekly Report 2026-11-05, 5 November 2026