YOOtheme Pro CVE-2026-77997

Exploitation requires an active, authenticated Joomla backend session with com_template editing permissions granted via Joomla's ACL. Anonymous or public-facing access is not possible - the Joomla administrative backend is the attack surface. The vulnerability is further scoped to sites running YOOtheme Pro versions 1.0.0-5.0.41 specifically. What limits exploitation: the attacker must already be a trusted (if partially privileged) backend user; the information disclosed is module metadata only, not credentials or file system data; and the Joomla administrative interface is typically not exposed to the internet without additional authentication (e.g., IP restriction, VPN). There is no lateral movement to unauthenticated access or code execution implied by this flaw alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N) correctly characterizes this as a medium-severity, highly-constrained flaw. PR:H means exploitation is limited to users who have already been granted com_template editing rights in the Joomla backend - a non-trivial privilege level. The confidentiality impact is low (VC:L): only module metadata is exposed, not credentials, file contents, or sensitive user data. Integrity and availability are unaffected. No EPSS score is available in the provided data, and the absence of a CISA KEV listing combined with the absence of any known POC indicates no confirmed or opportunistic exploitation. Real-world risk is low: this is an insider-trust-boundary issue affecting a subset of already-privileged backend users, not a remotely exploitable, pre-auth vector. The primary concern is that a malicious user with partial admin rights could enumerate module configurations to inform further privilege escalation attempts within the CMS.

An attacker who has been granted com_template editing rights in a Joomla site running YOOtheme Pro - for example, a web designer or content editor with limited admin access - navigates to the YOOtheme Pro template editor in the Joomla backend and issues requests that enumerate module configurations. Because the access check for com_modules is absent, the server returns module metadata (names, parameters, positions) for modules the user has no legitimate right to inspect. No public exploit code has been identified; exploitation requires only normal use of the template editor interface with a privileged session.