YOOtheme Pro EUVD-2026-63937

Exploitation requires a valid contributor-level (or higher) authenticated account on the target Joomla installation - an attacker cannot exploit this unauthenticated. The attack is delivered over the network via the Joomla web interface, with no additional attack requirements (AT:N per the CVSS 4.0 vector). Limiting factors: (1) the attacker must possess or obtain contributor credentials, confining risk to sites with registered or open-registration contributor users; (2) SSVC classifies the attack as not automatable, making mass opportunistic exploitation unlikely; (3) the vulnerability is confined to the YOOtheme Pro extension's content-handling functionality, not Joomla core, so sites not using YOOtheme Pro are unaffected. No special non-default configuration beyond having YOOtheme Pro installed and contributor users active is required.

The CVSS 4.0 base score of 8.6 reflects the severe database impact (VC:H/VI:H/VA:H), yet the practical exploitation probability is currently low: EPSS registers only 0.26% (18th percentile) and CISA SSVC confirms exploitation status as none with automatable classified as no, indicating targeted rather than mass-scale exploitation is expected. The provided CVSS 4.0 vector assigns PR:H, but the description specifies contributor-level access - in Joomla's role hierarchy, this is a relatively low-privilege account type akin to PR:L in CVSS 3.1 terms - meaning the authentication barrier may be lower than PR:H implies if open contributor registration is permitted on the target site. This discrepancy should be verified against the vendor advisory. There is no KEV listing and no confirmed public exploit code, further reducing immediacy. Real-world priority is highest in shared Joomla environments with open or lightly governed contributor access; tightly controlled deployments with trusted, vetted contributor accounts face substantially lower risk despite the high CVSS score.

An attacker registers or acquires a contributor-level account on a Joomla site running YOOtheme Pro 1.0.0-5.0.40, then submits a crafted content request through the extension's contributor interface embedding SQL metacharacters that alter the underlying query. This allows the attacker to enumerate database tables, extract user credentials or sensitive content, or modify database records. No public exploit code is currently known, but classic SQL injection techniques in an authenticated context are well within the capability of moderately skilled attackers.