CVE-2026-120548
5.3 MEDIUMPublished 2026-11-07 · Updated 2026-11-08
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-532
All references
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market
- https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2023-54407PoC
- HIGHCVE-2025-71423PoC
- HIGHCVE-2025-71425PoC
- MEDIUMCVE-2026-101168
- UNSCOREDCVE-2026-102289PoC
- HIGHCVE-2026-103371
- UNSCOREDCVE-2026-104055PoC
- MEDIUMCVE-2026-104872PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.