Vulnerabilities / YML for Yandex Market / WPSEC-2026-2177
YML for Yandex Market <= 5.10.0 - Missing Authorization to Unauthenticated Yandex Market API Connection Check
Medium 5.3
CWE-862Fixed in 5.11.0
- ID
- WPSEC-2026-2177
- Plugin
- YML for Yandex Market (yml-for-yandex-market)
- Affected
- from 5.8.0 before 5.11.0
- Remediation
- Update to 5.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-31
- Attack surface
- YML for Yandex Market on WPSec AttackSurface
- Fix released
- Published
Description
The YML for Yandex Market plugin for WordPress is vulnerable to unauthorized access via the 'y4ym_check_action' request parameter in versions 5.8.0 up to, and including, 5.10.0, due to a missing capability check and nonce verification in the listen_submits() function, which runs on the admin_init hook. This makes it possible for unauthenticated attackers to trigger the plugin's Yandex Market API connection check, which sends requests to the Yandex Market Partner API with the site's stored API key and writes the results to the plugin log.
References
- https://wpsec.com/vuln/WPSEC-2026-2177/
- https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.11.0/
- https://wordpress.org/plugins/yml-for-yandex-market/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS