Is my site affected?
Your site is affected if it runs YOOtheme Pro in any of these ranges:
- from 5.0.0 up to but not including 5.0.53
- from 5.0.41 up to but not including 5.0.42
- from 5.0.0 up to but not including 5.0.41
- before 4.5.34
- Latest safe version
- 5.0.53 or later. No rule we check matches that release or any newer one.
- What to do
- Update YOOtheme Pro to 5.0.53 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
YOOtheme Pro (yootheme) 5.0.0 to 5.0.52 - Unauthenticated Remote Code Execution via Image Handler (Critical)
YOOtheme Pro 5.0.0 to 5.0.52 is affected by CVE-2026-102785, which YOOtheme describes in its changelog as an unauthenticated remote code execution via the image handler. The vulnerable code is the public image cache route that YOOtheme Pro uses to serve resized and cropped images, which is reachable by any visitor with no login. Fixed in YOOtheme Pro 5.0.53, released 21 October 2026. Comparing the 5.0.52 and 5.0.53 packages shows the fix: the image controller now only accepts a fixed allow-list of image operations (type, crop, resize, rotate, flip, thumbnail) instead of any method on the image object, and it now checks that the requested cache file name matches the one generated for the signed image URL, so a request can no longer choose where the generated file is written. YOOtheme Pro 4 and earlier are not affected, according to the vendor. The CVE is reserved but its record is not yet published, so no official CVSS score is available. There is no interim mitigation: take a backup and update every YOOtheme Pro 5 site to 5.0.53 or later through the Joomla Extensions manager or your YOOtheme account, then run a new snapshot to clear this alert. YOOtheme Pro installs as both a template and a system plugin, both reporting the element yootheme, so a site normally shows two rows for this; updating YOOtheme Pro updates both together.
Affected versions: ≥ 5.0.0 and < 5.0.53
Full advisory: our disclosure post
YOOtheme Pro (yootheme) below 4.5.34 - Authenticated SQL Injection (CVSS 8.6), Arbitrary File Read (CVSS 7.0) and Broken Access Control (CVSS 5.1)
YOOtheme Pro below 4.5.34, the Joomla 3 branch, has three flaws reachable by an authenticated user who can edit templates. CVE-2026-76613 (CVSS 8.6) is an SQL injection in the page builder's article and tag source ORDER BY handling. CVE-2026-75115 (CVSS 7.0) is an arbitrary file read via a glob-pattern escape in the Filesystem source path filter. CVE-2026-77997 (CVSS 5.1) is a missing authorisation check in the module controller that returns any module's configuration to a user who holds only com_templates edit rights. All three are fixed in 4.5.34, released 24 August 2026. Update to 4.5.35, released 25 August 2026, which adds a regression fix for custom-field ordering in the Articles model. Sites on 1.x, 2.x, 3.x or 4.0 to 4.4 have no fixed release on their own line: the fix is to move to 4.5.35, or to migrate to the 5.0.x branch on Joomla 4/5/6. All three CVEs are scored PR:H, so an attacker needs an existing privileged account rather than anonymous access.
Affected versions: < 4.5.34
Full advisory: www.cve.org
YOOtheme Pro (yootheme) 5.0.0 to 5.0.40 - Authenticated SQL Injection (CVSS 8.6) and Arbitrary File Read (CVSS 7.0)
YOOtheme Pro 5.0.0 to 5.0.40, the Joomla 4/5/6 branch, has two flaws reachable by an authenticated user who can edit templates. CVE-2026-76613 (CVSS 8.6) is an SQL injection: the page builder's article and tag source queries put the ORDER BY column straight into the query without quoting it. CVE-2026-75115 (CVSS 7.0) is an arbitrary file read: the Filesystem source path filter can be stepped outside its root directories with glob patterns. Both are fixed in 5.0.41. Update to 5.0.42, which also fixes CVE-2026-77996 and CVE-2026-77997. YOOtheme keeps a separate Joomla 3 branch that fixes the same flaws in 4.5.34, so a site reporting 4.5.34 or later is patched and is covered by the matching 4.5.x advisory instead. Both CVEs are scored PR:H, so an attacker needs an existing privileged account rather than anonymous access.
Affected versions: ≥ 5.0.0 and < 5.0.41
Full advisory: www.cve.org
YOOtheme Pro (yootheme) 5.0.41 - Authenticated Broken Access Control in Module Controller (Information Disclosure, CVSS 5.1)
YOOtheme Pro 5.0.41's Page Builder module controller (ModuleController::getModule()) had no permission check of its own, unlike its sibling save endpoint which already required core.edit on com_modules.module.{id}. Reaching it via GET /index.php?option=com_ajax&p=/module&id=<id> returned that module's title, full params JSON (which can include API keys, raw HTML or JS, and other sensitive module configuration) and rendered content, for any module id on the site, published or unpublished. Published as CVE-2026-77997 by the Joomla CNA on 25 August 2026, CVSS 4.0 base 5.1 Medium (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N). The affected range on the record is 1.0.0 to 5.0.41. Exploitation requires an authenticated user who already holds core.edit on com_templates. YOOtheme's CheckUserPermission middleware runs on every route the framework dispatches and aborts with 403 (or redirects a guest to the login page) unless that permission is held, and the /module route does not opt out of it as the newsletter and image routes do. This is therefore a privilege boundary crossed sideways rather than an anonymous read: a user trusted to edit templates could read the configuration of any module on the site without holding any com_modules permission at all. Fixed in 5.0.42, which adds an explicit $user->authorise('core.edit', 'com_modules.module.{id}') check to getModule(). Confirmed by diffing the 5.0.41 and 5.0.42 packages and tracing the full request path. Note that YOOtheme Pro installs as both a template and a system plugin, and both report the element yootheme, so a single site normally shows two rows for this. Updating YOOtheme Pro updates both together. Update YOOtheme Pro to 5.0.42 or later through the Joomla Extensions manager, or download it from your YOOtheme account.
Affected versions: ≥ 5.0.41 and < 5.0.42
Full advisory: www.cve.org
Each CVE page above links its official cve.org record and its NVD entry.
