CVE-2026-120548

Name of the Vulnerable Software and Affected Versions YML for Yandex Market versions prior to 5.10.1

Description An issue exists where unauthenticated attackers can extract a merchant's plaintext Yandex Market API key. This occurs via the y4ym check action parameter, which allows access to a publicly accessible log file located at wp-content/uploads/y4ym/yml-for-yandex-market.log. Successful exploitation grants full control over the marketplace catalogue, prices, and stock. This requires the targeted feed to have a stored API key and the y4ym keeplogs option to be enabled.

Recommendations Update YML for Yandex Market to version 5.10.1 or later. Disable the y4ym keeplogs option to prevent the creation of the vulnerable log file.