YOOtheme Pro security vulnerabilities

mySites.guru tracks 2vulnerabilities in yootheme. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CVE-2026-76613

YOOtheme Pro (yootheme) below 5.0.41 - SQL Injection (CVSS 9.2) and Privileged Arbitrary File Read (CVSS 7.0)

Affected versions: < 5.0.41

YOOtheme Pro (yootheme) below 5.0.41 - SQL Injection (CVSS 9.2) and Privileged Arbitrary File Read (CVSS 7.0)

Affected versions: < 5.0.41

What we have written about YOOtheme Pro

A CVSS 10.0 Unauthenticated Upload in YOOtheme ZOO, Fixed in 4.1.66

YOOtheme ZOO (com_zoo) up to 4.1.63 had an unauthenticated file upload RCE scored CVSS 10.0, plus an unauthenticated SQL injection. Those are fixed in 4.1.64. Two more releases followed inside three days, closing five more issues between them, one of them scored 8.6. Install 4.1.66.

19 Aug 2026

Running YOOtheme Pro on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-76613. Rules current as of 24 August 2026.