Threat Pulse 62High
Unit 42: YOOtheme Pro CVE-2026-102785 exploited two days after patch
Severity 5PatchedconfirmedWeb servers and gateways

Scanners planted JPEG/PHP polyglot web shells on a WordPress site running a vulnerable YOOtheme Pro.

· 9 days ago · @Unit42_Intel on X
Sources@Unit42_Intel on X
On X
@Unit42_IntelverifiedOct 26, 21:11 UTC

We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details:

Open on X
Why this score

Plan rubric with caps (verified sweep, Oct 27)

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.