{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120548", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-11-02T16:24:53.444Z", "datePublished": "2026-11-07T09:25:45.776Z", "dateUpdated": "2026-11-07T09:25:45.776Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-07T09:25:45.776Z"}, "affected": [{"vendor": "icopydoc", "product": "YML for Yandex Market", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.10.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled \u2014 both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow."}], "title": "YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467"}, {"url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580"}, {"url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-532 Insertion of Sensitive Information into Log File", "cweId": "CWE-532", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kuba"}], "timeline": [{"time": "2026-11-06T21:24:33.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "YML for Yandex Market", "vendor": "icopydoc", "versions": [{"lessThanOrEqual": "5.10.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled \u2014 both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow."}], "id": "CVE-2026-120548", "lastModified": "2026-11-07T10:17:10.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-11-07T10:17:09.880", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/admin/class-y4ym-admin.php#L467"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/core/class-y4ym-error-log.php#L136"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/5.10.0/includes/feeds/import/class-y4ym-api.php#L580"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3774592%40yml-for-yandex-market&new=3774592%40yml-for-yandex-market"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33a2cf5c-d71f-45cf-8f8a-0edd47bc1974?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"created": "2026-11-07T11:00:18.199284+00:00", "updated": "2026-11-07T11:00:18.199289+00:00", "vendors": []}