Unauthenticated Remote Code Execution in YOOtheme Pro by YOOtheme

CVE-2026-102785

What is CVE-2026-102785?

An unauthenticated remote code execution vulnerability exists in YOOtheme Pro versions 5.0.0 to 5.0.52 due to improper binding of image operations and output destinations in its publicly accessible image transformation handler. This flaw allows an attacker to exploit a legitimate public image URL, injecting unauthorized image operations. By manipulating the request signature, an attacker can traverse beyond the intended cache directory and potentially write a maliciously crafted PNG/PHP polyglot to an executable media directory on the server, thereby compromising the web application.

References