Vulnerabilities / YML for Yandex Market / WPSEC-2026-2378
YML for Yandex Market <= 5.11.0 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log File
Medium 5.9
CWE-538Fixed in 5.12.0
- ID
- WPSEC-2026-2378
- Plugin
- YML for Yandex Market (yml-for-yandex-market)
- Affected
- from 5.8.0 before 5.12.0
- Remediation
- Update to 5.12.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-538
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- YML for Yandex Market on WPSec AttackSurface
- Fix released
- Published
Description
The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 5.8.0 up to, and including, 5.11.0. The cause is that the debug log is kept at a fixed, predictable path in the uploads directory without any access protection, and that a log written before 5.11.0 stays there after updating, including any Yandex Market API key recorded in it. This makes it possible for unauthenticated attackers to download the log and obtain API responses and, on updated sites, the API key, when plugin logging is or was enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2378/
- https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.12.0/
- https://wordpress.org/plugins/yml-for-yandex-market/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS