YOOtheme Pro CVE-2026-75115 and CVE-2026-76613: update to 5.0.41
YOOtheme Pro 5.0.41, released on 21 August 2026, fixes an arbitrary file-read vulnerability and an SQL injection vulnerability. Both require contributor-level access, so the immediate risk centers on untrusted, stale or compromised content-editor accounts.
Short answer: install 5.0.41 or later
Update YOOtheme Pro to 5.0.41 or later. Then review every account allowed to create or edit content. These flaws are not described by the vendor as unauthenticated, but a forgotten editor account or stolen contributor credentials can provide the required access.
The vendor changelog is deliberately concise. It confirms the access level and the vulnerability classes, but does not claim public exploitation or publish a broad affected-version range. This guide therefore does not invent either.
What contributor-level access means
The attacker needs a user account with content contribution permissions. That lowers exposure compared with a public unauthenticated flaw, but it does not make the update optional.
- Old editor accounts are frequently left active after staff or contractors leave.
- Password reuse or phishing can turn a legitimate contributor account into an entry point.
- Content workflows often grant more access than an account actually needs.
Review users by capability, not only by the visible Joomla group name. Remove stale accounts and reduce permissions that are no longer required.
CVE-2026-75115: arbitrary file read
YOOtheme states that CVE-2026-75115 allowed arbitrary file read by any contributor-level user. A file-read flaw can expose configuration, logs or other server-readable data depending on the hosting setup and process permissions.
After updating, check access logs for unusual requests from editor sessions and review whether sensitive files contain credentials that should now be rotated. Do not publish file paths or test payloads against a production site.
CVE-2026-76613: SQL injection
The same 5.0.41 release fixes an SQL injection available to contributor-level users. SQL injection can affect data confidentiality and integrity, so the response should include a database review rather than only replacing extension files.
- Check administrator and editor accounts created or changed recently.
- Review unexpected content, template settings and extension configuration changes.
- Preserve database and web access logs before cleanup.
Update and account-audit checklist
- Back up files, the database and logs before making cleanup changes.
- Install YOOtheme Pro 5.0.41 or later and confirm the displayed version.
- List every account with content creation or editing rights and remove stale users.
- End active sessions and reset credentials for accounts that are shared, weak or unexplained.
- Review access logs, database changes and template configuration around suspicious account activity.
- Rotate exposed secrets if sensitive configuration could have been read.
- Recheck the site after 24 hours and 7 days.
An update prevents future use of the fixed code paths. It cannot reverse a prior database change or invalidate data that may already have been read.
Check the public-facing site
The free checker can identify visible redirects, defacement, cloaking and some CMS signals without login access. It cannot audit user sessions, files or the database.
Primary sources
Unsure who had editor access?
Run the external check first, then audit Joomla users, sessions, files, database changes and logs if the installation was exposed before 5.0.41.
Frequently asked questions
Which YOOtheme Pro version fixes these CVEs?
YOOtheme lists both security fixes in YOOtheme Pro 5.0.41, released on 21 August 2026. Install 5.0.41 or a later release.
Can an unauthenticated visitor exploit these two flaws?
The vendor describes both as exploitable by contributor-level users. That means an account with content contribution access is required.
Should I remove old editor accounts after updating?
Yes. Remove stale accounts, end old sessions and reduce permissions to the minimum needed. A compromised contributor account can satisfy the access requirement.
Does updating prove that no data was read or changed?
No. Updating closes the fixed paths. Review logs, users and database changes if an untrusted or compromised contributor account may have existed.