MEDIUM 5.3 NVD
CVE-2026-120548
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.
References
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feed
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market
- https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-07 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.