In-the-wild exploitation of an unauthenticated remote code execution flaw in the YOOtheme Pro image handler for WordPress running Joomla has been observed. The vulnerability affects versions 5.0.0 through 5.0.52 and was patched in version 5.0.53. The initial access vector is fully automated, with the first webshell written two days after the patch release. The risk involves unauthorized command execution on web servers, allowing attackers to deploy malicious files and establish persistent access without requiring valid credentials or prior interaction with the target system.
The attack mechanism reuses a signed image URL already published on the target site, appending extra image operations to load the request body and save it as a PHP file in the uploads folder. The server returns an error code, but the file is successfully written. The webshell is a valid JPEG file with PHP code embedded in the metadata segment, allowing it to survive image re-encoding. The first-stage webshell requires no authentication and runs commands passed via a query parameter through the shell execution function. It provides a file-upload form and echoes a specific string on every request. On Windows hosts, commands run under the web server process. The scanner validates each drop within seconds by running a unique echo command followed by an identity check. An interactive operator later uploaded a second webshell and attempted to install a remote access tool, using residential proxy exit nodes for traffic.[/subscribe_to_unlock_form]
In-the-wild exploitation of an unauthenticated remote code execution flaw in the YOOtheme Pro image handler for WordPress running Joomla has been observed. The vulnerability affects versions 5.0.0 through 5.0.52 and was patched in version 5.0.53. The initial access vector is fully automated, with the first webshell written two days after the patch release. The risk involves unauthorized command execution on web servers, allowing attackers to deploy malicious files and establish persistent access without requiring valid credentials or prior interaction with the target system.
The attack mechanism reuses a signed image URL already published on the target site, appending extra image operations to load the request body and save it as a PHP file in the uploads folder. The server returns an error code, but the file is successfully written. The webshell is a valid JPEG file with PHP code embedded in the metadata segment, allowing it to survive image re-encoding. The first-stage webshell requires no authentication and runs commands passed via a query parameter through the shell execution function. It provides a file-upload form and echoes a specific string on every request. On Windows hosts, commands run under the web server process. The scanner validates each drop within seconds by running a unique echo command followed by an identity check. An interactive operator later uploaded a second webshell and attempted to install a remote access tool, using residential proxy exit nodes for traffic.[emaillocker id="1283"]
The campaign demonstrates rapid exploitation following the vulnerability disclosure, with automated scanning and manual follow-up operations. The use of generic tooling aimed at Linux hosts, despite targeting Windows servers, indicates a broad, indiscriminate approach. The deployment of a CGI helper kit and remote access tools suggests an intent to maintain long-term access and facilitate further lateral movement. Defensive implications include the need to promptly apply vendor patches, monitor for unexpected file writes in upload directories, and inspect web server logs for anomalous command execution patterns associated with image manipulation endpoints.
We recommend you to update YOOtheme Pro to version 5.0.53.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1190.001 | Exploit Public-Facing Application | Web Shell |
| Execution | T1059.003 | Command and Scripting Interpreter | Windows Command Shell |
| Execution | T1059.004 | Command and Scripting Interpreter | Unix Shell |
| Execution | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Defense Evasion | T1027.001 | Obfuscated Files or Information | Encoding or Obfuscation |
| Discovery | T1082 | System Information Discovery | - |
| Discovery | T1083 | File and Directory Discovery | - |
| Command and Control | T1071.001 | Application Layer Protocol | Web Service |
| Command and Control | T1105 | Ingress Tool Transfer | - |
| Command and Control | T1090.003 | Proxy | Multi-hop Proxy |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Execution | E1203 | Exploitation for Client Execution |
| File System Micro-objective | C0052 | Writes File |
| Execution | E1059 | Command and Scripting Interpreter |
| Discovery | E1082 | System Information Discovery |
| Command and Control | E1105 | Ingress Tool Transfer |
| Impact | B0022 | Remote Access |
| Defense Evasion | F0005 | Hidden Files and Directories |
| Communication Micro-objective | C0002 | HTTP Communication |
The following reports contain further technical details:
[/emaillocker]