r/joomla • u/mySitesGuru • 2h ago
Administration/Technical YOOtheme Pro 5: A Critical Security Update Is Coming on 21 October
mysites.guruYOOtheme has given a day's advance notice of a critical security update for YOOtheme Pro 5, the Joomla page-builder template. It is due on Wednesday 21 October at 16:00 CEST (14:00 UTC), and the vendor says every site running Pro 5 must update the moment the new version is available. YOOtheme Pro 4 and earlier are not affected, so if your sites are still on the Pro 4 line there is nothing to do here.
No technical details and no CVE are public yet. We did not find or investigate this one ourselves; it was reported to YOOtheme by a third party, so this is a heads-up rather than a write-up. There is no interim mitigation, so the useful thing to do tonight is take a fresh backup of each Pro 5 site and list which sites are on Pro 5, so you can move quickly tomorrow afternoon.
The full post has the vendor's exact wording, a short FAQ, and what we will publish once the fixed version is out.