CVE-2026-120548 · Package
NO FIX YET
The YML for Yandex Market WordPress plugin, up to and including 5.10.0, writes the merchant's plaintext Yandex Market API key to a publicly readable log file when the keep-logs option is enabled. An unauthenticated attacker who reads that log gains full control over the merchant's marketplace catalogue, prices and stock.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running the YML for Yandex Market plugin at version 5.10.0 or lower that have a Yandex Market feed with a stored API key. Exposure also requires the y4ym_keeplogs option to be enabled, which the advisory describes as normal usage. Sites without this plugin, without a stored Yandex Market API key, or with logging disabled are not exposed.
Not affected if keeplogs-disabled, no-api-key-stored, plugin-not-installed
Who cares e-commerce, woocommerce, wordpress, yandex-market
YML for Yandex Market plugin is installed and its version is 5.10.0 or lowery4ym_keeplogs is enabled in the plugin settingswp-content/uploads/y4ym/yml-for-yandex-market.log on the site and see whether it is publicly reachable and contains an API keyNo fix yet, per the sources.
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.