Date: 10/28/2026
Severity: Medium
Summary
Threat actors are actively exploiting CVE-2026-102785, an unauthenticated remote code execution vulnerability affecting YOOtheme Pro versions 5.0.0–5.0.52 used with WordPress and Joomla. Attackers use automated scanning to deploy JPEG/PHP polyglot webshells in the WordPress uploads directory, enabling remote command execution and file uploads. Follow-on activity included deploying an ALFA Team webshell, attempting to install the GSocket remote access tool, and downloading additional payloads, with traffic routed through Indonesian residential proxy networks. Organizations should upgrade to YOOtheme Pro 5.0.53 or later and inspect upload directories and server logs for suspicious webshells and commands.
Indicators of Compromise (IOC) List
Domains/URLs | https://raw.githubusercontent.com/kize7/zero/refs/heads/main/bin.php https://raw.githubusercontent.com/kize7/zero/refs/heads/main/us.php |
IP Address | 168.144.251.199 |
Hash | 1bbacae70b0e11e051783879bb63f667b4ee88b6b5676eabc7b09ea9afbc113c
6c0643d21f74c6d7eb3a441eb167ab7c544c191dcaab6bb1f09d43cd0d8a15e1
a2b2d11669115dab24ee1f82295fce67f1f93e316efe11a2c95018491e5cc484
f82fd317860454606003aa9dc7efde284d851424730e229f19c50d60206311b8
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/us.php" or url like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/us.php" or siteurl like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/us.php" or domainname like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/bin.php" or url like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/bin.php" or siteurl like "https://raw.githubusercontent.com/kize7/zero/refs/heads/main/bin.php" |
Detection Query 2 : | dstipaddress IN ("168.144.251.199") or srcipaddress IN ("168.144.251.199") |
Detection Query 3 : | sha256hash IN ("a2b2d11669115dab24ee1f82295fce67f1f93e316efe11a2c95018491e5cc484","f82fd317860454606003aa9dc7efde284d851424730e229f19c50d60206311b8","1bbacae70b0e11e051783879bb63f667b4ee88b6b5676eabc7b09ea9afbc113c","6c0643d21f74c6d7eb3a441eb167ab7c544c191dcaab6bb1f09d43cd0d8a15e1")
|
Reference
YOOtheme Pro Exploitation