CVE-2026-120548
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The YML for Yandex Market plugin for WordPress in versions up to and including 5.10.0 is vulnerable to Sensitive Information Exposure via the 'y4ym_check_action' parameter. Unauthenticated attackers can extract the merchant's plaintext Yandex Market API key written to a publicly accessible log file, granting full control over the merchant's marketplace catalogue, prices, and stock.
Risk Assessment
Exposure of the API key allows attackers to take control of the marketplace catalogue and pricing, potentially causing financial loss and reputational damage. Exploitation conditions (stored API key and enabled y4ym_keeplogs option) reflect normal, documented plugin usage.
Recommendation
Update the plugin to a version later than 5.10.0, disable the y4ym_keeplogs option, and remove the log file from wp-content/uploads/y4ym/. If needed, revoke and regenerate the Yandex Market API key.
Other vulnerabilities in YML for Yandex Market
Original NVD description (English source)
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS