CVE-2026-120548: YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

Q: Who can exploit this issue?

Any unauthenticated remote attacker can exploit it if the affected feed has a stored Yandex Market API key and log retention is enabled through the y4ym_keeplogs option. No WordPress account or administrative access is required.

Q: Are default or normal plugin deployments likely to be affected?

The vulnerable conditions are described as normal, documented plugin usage: storing a Yandex Market API key for a feed and enabling retained logs for support or feedback workflows. Deployments not using a stored API key or without y4ym_keeplogs enabled do not meet the stated exploitation prerequisites.

Q: What data can be exposed and what is the likely impact?

The publicly accessible log file can contain the merchant's plaintext Yandex Market API key. An attacker obtaining that key can gain full control over the merchant's marketplace catalogue, prices, and stock.

Q: How can I determine whether my site is exposed?

Check whether the site runs YML for Yandex Market version 5.10.0 or earlier, whether a feed has a Yandex Market API key stored, and whether the y4ym_keeplogs option is enabled. Also check for the log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, as this is the stated exposure location.

Published Nov 7, 2026

Updated

The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ymcheckaction' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ymkeeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin's own support and feedback workflow.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the y4ym_keeplogs option to prevent the plugin from retaining the publicly accessible log file containing the Yandex Market API key.
YML for Yandex Market y4ym_keeplogs = disabled

Event History

Nov 7, 2026

CVE Published

via MITRE·09:25 AM

Data Sourced

via MITRE·09:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can exploit it if the affected feed has a stored Yandex Market API key and log retention is enabled through the y4ym_keeplogs option. No WordPress account or administrative access is required.

Are default or normal plugin deployments likely to be affected?

The vulnerable conditions are described as normal, documented plugin usage: storing a Yandex Market API key for a feed and enabling retained logs for support or feedback workflows. Deployments not using a stored API key or without y4ym_keeplogs enabled do not meet the stated exploitation prerequisites.

What data can be exposed and what is the likely impact?

The publicly accessible log file can contain the merchant's plaintext Yandex Market API key. An attacker obtaining that key can gain full control over the merchant's marketplace catalogue, prices, and stock.

How can I determine whether my site is exposed?

Check whether the site runs YML for Yandex Market version 5.10.0 or earlier, whether a feed has a Yandex Market API key stored, and whether the y4ym_keeplogs option is enabled. Also check for the log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, as this is the stated exposure location.

CVE-2026-120548: YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default or normal plugin deployments likely to be affected?

What data can be exposed and what is the likely impact?

How can I determine whether my site is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default or normal plugin deployments likely to be affected?

What data can be exposed and what is the likely impact?

How can I determine whether my site is exposed?