Écran d'ordinateur affichant du code, rappelant une faille YOOtheme qui écrit un webshell PHP

YOOtheme Pro vulnerability CVE-2026-102785: webshells in your uploads, even after an HTTP 500

Does your WordPress site run YOOtheme Pro? Since late October 2026, a YOOtheme vulnerability has let a stranger, with no account, write a PHP file into your uploads folder. The fix shipped on October 21 (version 5.0.53). Two days later, Unit 42 already observed the first webshell in the wild. On November 5, JPCERT/CC’s weekly report flagged the campaign again.

Here’s how the YOOtheme vulnerability works, what to hunt in your files and logs, and why updating alone isn’t enough if someone got in first.

YOOtheme vulnerability: what CVE-2026-102785 allows

YOOtheme Pro (WordPress and Joomla, versions 5.0.0 to 5.0.52) exposes an image handler that signs transformation URLs. The signature didn’t cover every extra operation or where the result is saved. An attacker reuses a signed image URL already published on your site, appends operations, and forces a .php file into wp-content/uploads. No login. The CVSS score is 10.0 (GitHub advisory GHSA-8w8j-f6ph-29mm).

Malicious request (Unit 42 pattern — typical parameters)
GET/index.php?yootheme=cache/…-.png&src=…&hash=a1b2c3d4
&FromFile=php://input
&Save=wp-content/uploads/yt3a9f0c1.php,jpeg,90
HTTP500 Internal Server Error  ← the file is written anyway

How to read this mockup

1The attacker reuses a signed image URL already public on the site.
2FromFile=php://input: the request body becomes the content of the written file.
3Save=…/yt….php: forced destination under wp-content/uploads (yt + 7 hex).
4HTTP 500: the server may answer with an error… and still write the file.

The dropped file is a valid JPEG with PHP hidden in the APP13 metadata. To the eye, it looks like a picture. To PHP, it’s an executable script.

What Unit 42 saw in two minutes

According to Unit 42’s October 26, 2026 note:

an automated scanner drops the first webshell;
within about 3 seconds, it validates with an echo marker then id;
about 2 minutes later, a human operator may drop a fuller ALFA Team shell, write an ALFA_DATA folder and try to install a remote-access tool.

The first-stage shell has no password: it runs the c parameter and prints WPCONFIG on every request. Treat any hit as a full site compromise.

Compromise indicator checklist

Hunt for this today (even if you’re already on 5.0.53)

☐ Files named yt + 7 hex characters + .php under wp-content/uploads (e.g. yt3a9f0c1.php).
☐ Any other unexpected .php in uploads, including dated subfolders.
☐ A wp-content/uploads/ALFA_DATA/ folder (or alfacgiapi).
☐ In access logs: index.php requests containing both FromFile=php://input and Save= — including HTTP 500 responses.
☐ WordPress administrator accounts created or changed without reason since about October 21.
☐ An expired YOOtheme API key / licence: an update can fail without you noticing.

What to do, in what order

1. Check the version

Appearance > Themes, or the YOOtheme customizer

If you’re on 5.0.0–5.0.52, move immediately to 5.0.53 or newer. Confirm the version number after updating.

2. Hunt for webshells

Uploads + logs since October 21

The update closes the door. It does not remove a file already planted.

3. Isolate if you find something

Cut public access if needed

Treat the site as compromised: forensic backup, then cleanup.

4. Rotate secrets

Database + admin accounts

Change WordPress passwords (every admin), API keys, and secrets in wp-config.php. Regenerate salts if needed.

5. Keep watching

Files and logs

Watch for new .php files in uploads and unusual yootheme= requests.

We’ve already seen how a flaw in a website tool becomes an open door until you hunt what was left behind, as with stolen UpdraftCentral keys or a critical PHP vulnerability.

Frequently asked questions

Q1. I updated to 5.0.53. Am I done?

The YOOtheme vulnerability is fixed for new attacks. If the site ran a vulnerable version after about October 23, still hunt for webshells and log traces.

Q2. YOOtheme Pro is paid: can the update fail?

Yes. Without a valid API key / licence, the update may not install. Check the version number shown after you click Update.

Q3. Is an HTTP 500 in the logs reassuring?

No. For this YOOtheme vulnerability, the server can return 500 and still write the file. Don’t filter out 500s when hunting FromFile and Save.

Q4. Joomla too?

Yes. YOOtheme Pro 5.0.0–5.0.52 is affected on WordPress and on Joomla. The fix is the same: 5.0.53 or newer.

How NeoTech can help

We check your YOOtheme Pro version, apply the fix, hunt uploads and logs, and rotate credentials if anything was found. Our website design and maintenance services include tested updates for premium themes, and our automated 24/7 monitoring with on-call technician response flags new PHP files in public folders and suspicious requests. For all your protections, see our cybersecurity services.

Book your free cyber check

In 30 minutes, we check together whether your site uses YOOtheme Pro, which version is installed, and whether your uploads need a closer look.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Our office: 2572 boul. Daniel-Johnson, office 237, Laval.

Sources

Photo: luis gomes, Pexels (Pexels licence).