Joomla sites using YOOtheme Pro should update to version 5.0.41 as a security priority. The vendor identifies this release as the fix for CVE-2026-75115 and CVE-2026-76613, which affect earlier YOOtheme Pro releases on Joomla. One issue could expose files to a lower-privilege content account, while the other could affect database queries. The vendor’s current changelog identifies 5.0.41 as the corrected release.
What to do now
- Confirm the installed YOOtheme Pro version. Check the Joomla administrator area and record the result in your normal maintenance ticket. Treat releases through 5.0.40 as needing the update.
- Update YOOtheme Pro through Joomla’s update system. Install 5.0.41 from the official YOOtheme channel. Keep the update inside an established maintenance window when the site has a busy public audience.
- Review lower-privilege content access. Remove accounts that no longer need to create or edit content. Confirm that every remaining editor has an individual account and only the permissions required for their job.
- Verify the public site after the update. Check key pages, forms, navigation, media, and the administrator sign-in path. Clear only the site’s normal page cache if the change is not visible immediately.
Who is affected
This guidance is for Joomla installations running YOOtheme Pro before 5.0.41. The vendor describes the two fixes as issues reachable by a content-level account, so the practical risk is higher on sites with many authors, contractors, shared editor accounts, or an unreviewed front-end content workflow. We found no CISA KEV entry or vendor notice of active exploitation during this review, but that is not a reason to postpone the update.
Keep the maintenance change controlled
Use the site’s established recovery and approval process before making production changes. This guide does not create a full-account backup, webroot snapshot, uploads archive, database export, or change to a customer backup schedule. After the update, preserve only the administrative result of your checks, not visitor or customer data.
Related site-support checks
Teams responsible for more than one CMS can use the same account-review and maintenance discipline for WordPress through Fix I.T. Phill WordPress Support. Joomla administrators can also review our Joomla JCE security update guide for a similar vendor-led patch workflow.