CVE-2025-14545

MediumCVSS 6.5

Published: 10/04/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process.

Risk Assessment

An attacker could remotely execute arbitrary code on the server, leading to full system compromise. This could result in data theft, backdoor installation, or using the server for further attacks.

Recommendation

Immediately update the YML for Yandex Market plugin to version 5.0.26 or later. Until the update, consider disabling the plugin.

Other vulnerabilities in YML for Yandex Market

CVE-2026-120548Medium
The YML for Yandex Market plugin for WordPress in versions up to and including 5.10.0 is vulnerable to Sensitive Information Exposure via the 'y4ym_check_action' parameter. Unauthenticated attackers can extract the merchant's plaintext Yandex Market API key written to a publicly accessible log file, granting full control over the merchant's marketplace catalogue, prices, and stock.

Original NVD description (English source)

The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS