{
 "id": "WPSEC-2026-2177",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2177/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2177/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2177/index.md",
 "title": "YML for Yandex Market <= 5.10.0 - Missing Authorization to Unauthenticated Yandex Market API Connection Check",
 "description": "The YML for Yandex Market plugin for WordPress is vulnerable to unauthorized access via the 'y4ym_check_action' request parameter in versions 5.8.0 up to, and including, 5.10.0, due to a missing capability check and nonce verification in the listen_submits() function, which runs on the admin_init hook. This makes it possible for unauthenticated attackers to trigger the plugin's Yandex Market API connection check, which sends requests to the Yandex Market Partner API with the site's stored API key and writes the results to the plugin log.",
 "plugin": {
  "slug": "yml-for-yandex-market",
  "name": "YML for Yandex Market",
  "full_name": "YML for Yandex Market",
  "wordpress_org": "https://wordpress.org/plugins/yml-for-yandex-market/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yml-for-yandex-market/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yml-for-yandex-market"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.8.0",
    "from_inclusive": true,
    "to": "5.11.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.8.0 before 5.11.0"
  ]
 },
 "introduced_in": "5.8.0",
 "fixed_in": "5.11.0",
 "remediation": "Update to 5.11.0 or later.",
 "fix_released": "2026-10-30T07:19:47+00:00",
 "published": "2026-10-31T07:44:03+00:00",
 "updated": "2026-10-30T09:30:31.504617+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2177/",
  "https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.11.0/",
  "https://wordpress.org/plugins/yml-for-yandex-market/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yml-for-yandex-market",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-31"
 }
}