{
 "id": "WPSEC-2026-2378",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2378/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2378/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2378/index.md",
 "title": "YML for Yandex Market <= 5.11.0 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log File",
 "description": "The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 5.8.0 up to, and including, 5.11.0. The cause is that the debug log is kept at a fixed, predictable path in the uploads directory without any access protection, and that a log written before 5.11.0 stays there after updating, including any Yandex Market API key recorded in it. This makes it possible for unauthenticated attackers to download the log and obtain API responses and, on updated sites, the API key, when plugin logging is or was enabled.",
 "plugin": {
  "slug": "yml-for-yandex-market",
  "name": "YML for Yandex Market",
  "full_name": "YML for Yandex Market",
  "wordpress_org": "https://wordpress.org/plugins/yml-for-yandex-market/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yml-for-yandex-market/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yml-for-yandex-market"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-538"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.8.0",
    "from_inclusive": true,
    "to": "5.12.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.8.0 before 5.12.0"
  ]
 },
 "introduced_in": "5.8.0",
 "fixed_in": "5.12.0",
 "remediation": "Update to 5.12.0 or later.",
 "fix_released": "2026-10-31T10:46:59+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:41:19.539324+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2378/",
  "https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.12.0/",
  "https://wordpress.org/plugins/yml-for-yandex-market/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yml-for-yandex-market",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-03"
 }
}