Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence
CVE-2026-120548YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php
Medium 5.3
In plain English
A medium-severity sensitive data in logs in YML for Yandex Market from icopydoc. There are no confirmed reports of exploitation so far.
Official description
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| icopydoc | YML for Yandex Market | 0 – through 5.10.0 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580
- https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market