YOOtheme Pro EUVD-2026-108161

Target must run YOOtheme Pro for Joomla in the affected range 5.0.0-5.0.52 with its publicly accessible image-transformation handler reachable (the default for sites using the builder's dynamic image rendering). The attacker needs a valid request signature, which is trivially obtainable because it is disclosed in any legitimate public image URL on the site, so no account or authentication is required. Exploitation leading to code execution also depends on the target media directory being web-executable for PHP (typical of standard PHP/Joomla deployments); the main limiting factors are the specific vulnerable version range and the handler being enabled/reachable, with no user interaction required.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk case. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity exploitation with no attack requirements, and the chain ends in attacker-controlled code execution (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H), consistent with the 10.0 score and CWE-434. The SSVC-style signals reinforce urgency: the vuln.today Decision label is act_now, the CVSS threat metrics show E:A (Attacked) and AU:Y (Automatable), and the technical impact is total. However, note a conflict/gap: the input does NOT include an explicit CISA KEV flag or an EPSS score, yet the CVSS 4.0 vector asserts E:A (exploitation 'Attacked'); this exploitation-maturity claim is embedded in the vector rather than confirmed by a CISA KEV listing in the provided data, so active exploitation should be treated as claimed-but-not-KEV-confirmed. The only reference is the vendor homepage (https://www.yootheme.com/) with no dedicated advisory URL, so fixed-version and exploitation details could not be independently corroborated. Even discounting the unconfirmed exploitation claim, the combination of unauthenticated network RCE, automatability, and a widely used Joomla page builder makes this an immediate patch priority.

An unauthenticated attacker visits a target Joomla site running YOOtheme Pro and copies a valid signature from any legitimate public image-transformation URL, then crafts a new request that reuses that signature while injecting extra image operations and a traversal path. Because the signature does not fully bind the operations or output destination, the handler writes an attacker-controlled PNG/PHP polyglot into a web-executable media directory, which the attacker then requests to run arbitrary PHP as the web server. No public exploit is identified in the provided references (only the vendor homepage), though the CVSS threat metric asserts exploitation activity.