# YML for Yandex Market <= 5.10.0 - Missing Authorization to Unauthenticated Yandex Market API Connection Check

- **ID:** WPSEC-2026-2177
- **Plugin:** YML for Yandex Market (`yml-for-yandex-market`), https://wordpress.org/plugins/yml-for-yandex-market/
- **Affected versions:** from 5.8.0 before 5.11.0
- **Fixed in:** 5.11.0 (Update to 5.11.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yml-for-yandex-market
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2177/

## Description

The YML for Yandex Market plugin for WordPress is vulnerable to unauthorized access via the 'y4ym_check_action' request parameter in versions 5.8.0 up to, and including, 5.10.0, due to a missing capability check and nonce verification in the listen_submits() function, which runs on the admin_init hook. This makes it possible for unauthenticated attackers to trigger the plugin's Yandex Market API connection check, which sends requests to the Yandex Market Partner API with the site's stored API key and writes the results to the plugin log.

## References

- https://wpsec.com/vuln/WPSEC-2026-2177/
- https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.11.0/
- https://wordpress.org/plugins/yml-for-yandex-market/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2177/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.