# YML for Yandex Market <= 5.11.0 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log File

- **ID:** WPSEC-2026-2378
- **Plugin:** YML for Yandex Market (`yml-for-yandex-market`), https://wordpress.org/plugins/yml-for-yandex-market/
- **Affected versions:** from 5.8.0 before 5.12.0
- **Fixed in:** 5.12.0 (Update to 5.12.0 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-538
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yml-for-yandex-market
- **Fix released:** 2026-10-31
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2378/

## Description

The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 5.8.0 up to, and including, 5.11.0. The cause is that the debug log is kept at a fixed, predictable path in the uploads directory without any access protection, and that a log written before 5.11.0 stays there after updating, including any Yandex Market API key recorded in it. This makes it possible for unauthenticated attackers to download the log and obtain API responses and, on updated sites, the API key, when plugin logging is or was enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2378/
- https://plugins.svn.wordpress.org/yml-for-yandex-market/tags/5.12.0/
- https://wordpress.org/plugins/yml-for-yandex-market/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2378/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.