Quick answers
- Is CVE-2026-77029 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77029 being exploited in the wild.
- How severe is CVE-2026-77029?
- Informational severity, published 21 August 2026.
- Which products and versions are affected?
- YOOtheme Zoo < 4.1.66.
- Is there a fix for CVE-2026-77029?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77029 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77029?
- Check whether you run YOOtheme Zoo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in YOOtheme Zoo versions before 4.1.66, where front-end state-changing operations lack proper CSRF token validation. An attacker can craft a malicious webpage or email that, when visited by an authenticated Zoo user, silently executes state-changing actions without the user's explicit consent. The attack vector is network-based and requires no special privileges, though it does require the user to be authenticated and visit an attacker-controlled page while logged in. Affected versions prior to 4.1.66 are vulnerable; users should upgrade to 4.1.66 or later to remediate.
Affected products
- YOOtheme Zoo < 4.1.66
Timeline
- 2026-08-21: disclosed