{"id":"CVE-2026-120548","kind":"vulnerability","aliases":["CVE-2026-120548"],"related":[],"title":"WordPress YML for Yandex Market plugin leaks merchant API key in public log","description":"The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.","summary":"The YML for Yandex Market WordPress plugin, up to and including 5.10.0, writes the merchant's plaintext Yandex Market API key to a publicly readable log file when the keep-logs option is enabled. An unauthenticated attacker who reads that log gains full control over the merchant's marketplace catalogue, prices and stock.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","package","woocommerce","wordpress","yandex-market"],"not_affected_if":["keeplogs-disabled","no-api-key-stored","plugin-not-installed"],"how_to_check":"- Check whether the `YML for Yandex Market` plugin is installed and its version is `5.10.0` or lower\n- Check whether the option `y4ym_keeplogs` is enabled in the plugin settings\n- Request `wp-content/uploads/y4ym/yml-for-yandex-market.log` on the site and see whether it is publicly reachable and contains an API key","fix":null,"status":"open","published_at":"2026-11-07T10:17:09+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:46+00:00","updated_at":"2026-11-07T10:48:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T10:48:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress YML for Yandex Market plugin leaks merchant API key in public log","impact":"high","summary":"The YML for Yandex Market WordPress plugin, up to and including 5.10.0, writes the merchant's plaintext Yandex Market API key to a publicly readable log file when the keep-logs option is enabled. An unauthenticated attacker who reads that log gains full control over the merchant's marketplace catalogue, prices and stock.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yandex-market","e-commerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads Yandex Market API key and controls merchant catalogue and prices","analyst_note":"Sources give no fixed version for this CVE; check the NVD entry and the WordPress plugin repository changelog for a patched release after 5.10.0.","how_to_check":"- Check whether the `YML for Yandex Market` plugin is installed and its version is `5.10.0` or lower\n- Check whether the option `y4ym_keeplogs` is enabled in the plugin settings\n- Request `wp-content/uploads/y4ym/yml-for-yandex-market.log` on the site and see whether it is publicly reachable and contains an API key","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-api-key-stored","keeplogs-disabled"],"who_is_affected":"WordPress sites running the YML for Yandex Market plugin at version 5.10.0 or lower that have a Yandex Market feed with a stored API key. Exposure also requires the y4ym_keeplogs option to be enabled, which the advisory describes as normal usage. Sites without this plugin, without a stored Yandex Market API key, or with logging disabled are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000786,"input_tokens":4385,"output_tokens":695,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120548':16A,19A '-2026':15A,18A '/uploads/y4ym/yml-for-yandex-market.log':139C '5.10.0':40B,104C 'access':132C 'action':109C 'activ':181C 'api':9A,48B,126C,163C 'attack':66B,117C 'catalogu':79B,148C 'check':108C 'commerc':22B 'condit':174C 'content':138C 'control':73B,142C 'cve':14A,17A 'document':178C 'e':21B 'e-commerc':20B 'enabl':63B,172C 'encourag':182C 'exploit':152C 'exposur':96C 'extract':119C 'feed':157C 'feedback':190C 'file':55B,134C 'full':72B,141C 'gain':71B 'grant':140C 'includ':39B,103C 'inform':95C 'keep':59B 'keep-log':58B 'keeplog':169C 'key':10A,49B,127C,164C 'leak':7A 'log':13A,54B,60B,70B,133C 'make':112C 'market':5A,28B,33B,47B,87C,125C,162C 'marketplac':78B,147C 'merchant':8A,43B,76B,121C,145C 'normal':177C 'option':61B,170C 'packag':23B 'paramet':110C 'plaintext':45B,123C 'plugin':6A,35B,88C,179C,185C 'possibl':114C 'price':80B,149C 'public':12A,52B,131C 'read':68B 'readabl':53B 'repres':176C 'requir':153C 'sensit':94C 'stock':82B,151C 'store':160C 'support':188C 'target':156C 'unauthent':65B,116C 'usag':180C 'version':99C 'via':105C 'vulner':92C 'woocommerc':24B 'wordpress':1A,25B,34B,90C 'workflow':191C 'wp':137C 'wp-content':136C 'write':41B 'written':128C 'y4ym':107C,168C 'yandex':4A,27B,32B,46B,86C,124C,161C 'yandex-market':26B 'yml':2A,30B,84C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the YML for Yandex Market plugin at version 5.10.0 or lower that have a Yandex Market feed with a stored API key. Exposure also requires the y4ym_keeplogs option to be enabled, which the advisory describes as normal usage. Sites without this plugin, without a stored Yandex Market API key, or with logging disabled are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","woocommerce","wordpress","yandexmarket"],"campaign_type":null,"search_a":"'-120548':16A,19A '-2026':15A,18A 'api':9A 'cve':14A,17A 'key':10A 'leak':7A 'log':13A 'market':5A 'merchant':8A 'plugin':6A 'public':12A 'wordpress':1A 'yandex':4A 'yml':2A","search_b":"'5.10.0':40B 'api':48B 'attack':66B 'catalogu':79B 'commerc':22B 'control':73B 'e':21B 'e-commerc':20B 'enabl':63B 'file':55B 'full':72B 'gain':71B 'includ':39B 'keep':59B 'keep-log':58B 'key':49B 'log':54B,60B,70B 'market':28B,33B,47B 'marketplac':78B 'merchant':43B,76B 'option':61B 'packag':23B 'plaintext':45B 'plugin':35B 'price':80B 'public':52B 'read':68B 'readabl':53B 'stock':82B 'unauthent':65B 'woocommerc':24B 'wordpress':25B,34B 'write':41B 'yandex':27B,32B,46B 'yandex-market':26B 'yml':30B","search_c":"'/uploads/y4ym/yml-for-yandex-market.log':139C '5.10.0':104C 'access':132C 'action':109C 'activ':181C 'api':126C,163C 'attack':117C 'catalogu':148C 'check':108C 'condit':174C 'content':138C 'control':142C 'document':178C 'enabl':172C 'encourag':182C 'exploit':152C 'exposur':96C 'extract':119C 'feed':157C 'feedback':190C 'file':134C 'full':141C 'grant':140C 'includ':103C 'inform':95C 'keeplog':169C 'key':127C,164C 'log':133C 'make':112C 'market':87C,125C,162C 'marketplac':147C 'merchant':121C,145C 'normal':177C 'option':170C 'paramet':110C 'plaintext':123C 'plugin':88C,179C,185C 'possibl':114C 'price':149C 'public':131C 'repres':176C 'requir':153C 'sensit':94C 'stock':151C 'store':160C 'support':188C 'target':156C 'unauthent':116C 'usag':180C 'version':99C 'via':105C 'vulner':92C 'wordpress':90C 'workflow':191C 'wp':137C 'wp-content':136C 'written':128C 'y4ym':107C,168C 'yandex':86C,124C,161C 'yml':84C","first_public_at":"2026-11-07T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120548","severity":null,"published_at":"2026-11-07T10:17:09+00:00","modified_at":"2026-11-07T10:17:10+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}