YOOtheme Zoo CVE-2026-75114

The Zoo extension for Joomla must be installed and active on the target site. The CommentController::twitterAuthenticate() method must be reachable, meaning the Twitter/social authentication feature within Zoo comments must be enabled - this is likely a non-default or opt-in configuration. Exploitation requires user interaction: the victim must click a crafted link or be redirected to the vulnerable endpoint. No authentication or privileges are required on the attacker's part. Exploitation is limited by: (1) the need for the Zoo extension to be installed; (2) the Twitter authentication feature being enabled in Zoo; (3) victim interaction with the crafted URL.

The CVSS 4.0 score of 5.1 (vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a medium-severity issue: exploitation is network-accessible, requires no authentication, and no attack preconditions, but does require user interaction (UI:A) and impacts are confined to the subsequent system with low integrity effect. EPSS data is not provided, limiting probabilistic exploitation forecasting. No KEV listing and no reported POC further reduce near-term urgency. The primary real-world risk is phishing: an attacker who can craft a malicious link pointing to the twitterAuthenticate endpoint can redirect a victim to an attacker-controlled site after interaction, facilitating credential harvesting or malware delivery. Because Zoo is a Joomla extension rather than a core component, the blast radius is limited to sites that have it installed and have the comment/Twitter authentication feature active. This is a genuine vulnerability warranting patching during normal maintenance cycles, but it does not warrant emergency response absent KEV confirmation or targeted exploitation evidence.

An attacker crafts a Joomla URL pointing to the Zoo CommentController::twitterAuthenticate() endpoint with a referer parameter set to an attacker-controlled phishing domain. The attacker distributes this link via email or social media; when a Joomla site visitor clicks it and completes the simulated Twitter authentication flow, they are transparently redirected to the malicious site. No public exploit code is known at time of analysis, but the attack is trivially constructable by any attacker familiar with open redirect techniques.