{"affected":[{"defaultStatus":"unaffected","product":"YML for Yandex Market","source":"CNA: Wordfence","vendor":"icopydoc","versions":[{"lessThanOrEqual":"5.10.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-120548","cwes":["CWE-532"],"description":"The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794046630027,"publishedAt":1794043545776,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve"}],"remediation":[],"revision":"04773dc8ab8d7949bdc1742a2d388e38ed4b44e690e41d10f020ae9a0a3327ad","sources":[{"modifiedAt":1794043545776,"name":"CNA: Wordfence","retrievedAt":1794046120740,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120548"},{"modifiedAt":1794046630027,"name":"NVD","retrievedAt":1794053773351,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120548"}],"ssvc":null,"status":"published","title":"YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php","updatedAt":1794053773351}