Scan my site freeScan free

Fix guides / Security notices

Security notice

Site built on YOOtheme Pro? A flaw rated 10.0 lets anyone with no login plant a PHP file. Attacks are reported. Update to 5.0.53.

Last updated: Thursday, November 5, 2026, 8:13 AM ETStatus: Fix released. Attacks reported by Palo Alto Networks Unit 42. Update now.

YOOtheme Pro is a page builder and theme for WordPress and Joomla sites. In versions 5.0.0 through 5.0.52, a flaw lets anyone with no account make the site write a PHP file into a public folder, and a PHP file on a website is a way for a stranger to run their own code on it. The YOOtheme changelog lists it as CVE-2026-102785, and the GitHub Advisory rates it 10.0 out of 10. The fix, version 5.0.53, came out on October 21, 2026. Palo Alto Networks Unit 42 reports that attacks began about two days later, that an automated scanner left webshells on sites and that a person then added a bigger toolkit. JPCERT/CC notes the same report in its November 5 weekly list. CISA KEV does not list the flaw as exploited. If a site of yours runs YOOtheme Pro, update it to 5.0.53 or later today. Updating closes the hole but does not remove files an attacker already left, so also check the site for them.

What happened

Who should worry

This is about WordPress and Joomla sites that use the YOOtheme Pro theme or page builder, often a site built by an agency or freelancer. If you are not sure whether yours does, ask whoever built it. Ask about this if any of these are true:

If your site does not use YOOtheme Pro, this notice does not apply to you.

What to do now

Do these today.

  1. Check if you have it. On WordPress, open Appearance, then Themes, and look for YOOtheme, or ask your developer. On Joomla, open System, then Site Templates, or ask your developer. Note the version. 5.0.53 or later has the fix. (YOOtheme changelog)
  2. Update YOOtheme Pro to 5.0.53 or later after taking a backup, and confirm the version afterwards. (YOOtheme changelog)
  3. Check for a break-in, especially if the site ran 5.0.52 or older after October 21. Ask your developer or host to do the checks Unit 42 lists for WordPress sites: look in wp-content/uploads for PHP files, especially names that start with yt, then seven letters or numbers, then .php; look for a folder called wp-content/uploads/ALFA_DATA; and search the web server logs for requests to index.php that contain both FromFile=php://input and Save=, including ones that got an HTTP 500 error, because the server can show an error even though the file was written. (Unit 42)
  4. On Joomla, the same idea applies: ask your developer to look for PHP files in the public image and media folders and to search the logs the same way. That is our suggestion. The Unit 42 checks are written for WordPress. (Unit 42)
  5. If you find anything, treat the site as taken over. Unit 42 says the webshell is built to read wp-config.php, which holds the database login. Change the database password and every administrator password, and involve your host. If you find nothing, that is not proof the site is clean, so keep the logs. (Unit 42)
  6. If you cannot update today, ask your host or developer about taking the site offline until you can. That is our suggestion, not the maker's.

What to send your developer, agency or host

YOOtheme Pro 5.0.0 through 5.0.52, on WordPress and Joomla, has a critical flaw, CVE-2026-102785 (rated 10.0 by the GitHub Advisory, CVE published October 22, 2026): unauthenticated remote code execution through the image handler. 5.0.53 (October 21, 2026) is the fix. Palo Alto Networks Unit 42 reports attacks starting about two days after the fix, with webshells written to wp-content/uploads. Please update every site we have on YOOtheme Pro to 5.0.53 or later, then check each one for PHP files in wp-content/uploads (names like yt plus seven characters plus .php), a wp-content/uploads/ALFA_DATA folder, and web log requests to index.php containing both FromFile=php://input and Save= (including HTTP 500 responses). If anything matches, treat the site as compromised and rotate the database and administrator passwords. Thank you. Sources: YOOtheme changelog, Unit 42, GitHub Advisory, JPCERT/CC.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw has a fix, and a security firm reports attacks. The way to know is to update and do the checks above.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which themes or plugins your site runs, which versions they are on or what files are on your server, so if our scan does not warn you about this theme, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

I updated already. Am I fine?

Updating to 5.0.53 or later stops new attacks through this flaw. It does not remove a file an attacker already wrote. If the site ran 5.0.52 or older after October 21, do the break-in checks above. (Unit 42)

Is it on CISA's list?

No. CISA KEV does not list CVE-2026-102785 as exploited in the data we could check through November 4, 2026. Palo Alto Networks reports attacks all the same, and JPCERT/CC repeats that. (CISA KEV, Unit 42, JPCERT/CC)

Where can I follow official updates?

The YOOtheme changelog, the GitHub Advisory and the NVD entry. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan cannot see which WordPress plugins your site runs, which version they are on, or what files are on your server. No account.

Or sign up free and we check it every day and email you when something changes.