Atomicorp WAF Rule 398127

Rule Summary

• Rule ID: 398127
• Status: Active
• Alert message: Atomicorp.com WAF Rules: YOOtheme Pro image handler file-source operation blocked (CVE-2026-102785)
• Observed CWEs: None documented
• Revision: 1
• Phase: 2 (request body)
• Request surfaces: Request filename
• Rule action: deny
• HTTP status: 403
• Public tags: attack-surface/yootheme-image-handler, cve/CVE-2026-102785
• Logging: log

Description

Rule 398127 blocks a request pattern used to exploit the YOOtheme Pro image handler, associated with YOOtheme Pro vulnerability CVE-2026-102785 . The rule is a deployed blocking control included in this engineering finding.

Alert interpretation

The rule’s action is to deny the matching request with HTTP 403 and record an alert. Investigate alerts using sanitized evidence and Atomicorp Support’s private support channels.

Recommended action

Update YOOtheme Pro to 5.0.53 or a later release on every Joomla and WordPress site that uses it, following the YOOtheme changelog (opens in a new tab) . YOOtheme Pro 4 and earlier are not affected.

Exploitation has been reported since October 21, 2026, before the fix was available. Check sites that ran an affected version for signs of compromise, including PHP files in image, cache or media directories and files changed since that date. Updating does not remove files an attacker has already placed; follow your incident response process and keep Atomicorp rules current.

References

• GitHub Advisory Database: GHSA-8w8j-f6ph-29mm (opens in a new tab)
• CVE record (opens in a new tab)
• YOOtheme Pro changelog (opens in a new tab)

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2026-102785

A cached public vulnerability description is not currently available for this CVE.

• Association: The rule references CVE-2026-102785 in its alert message and tag.
• CVE Record (opens in a new tab)
• NVD (opens in a new tab)

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.