Executive brief
The YML for Yandex Market plugin for WordPress, which helps e-commerce sites sync products with Yandex Market, contains a security flaw that allows authorized users to take over the web server. By manipulating the product feed generation settings, an attacker with Shop Manager or higher privileges can upload and execute malicious code. This could lead to a complete site compromise, theft of customer data, or the installation of ransomware.
Technical details
The YML for Yandex Market plugin for WordPress is vulnerable to Remote Code Execution (RCE) in versions prior to 5.0.26. The vulnerability exists within the feed generation process where the 'Change domain to' field in the Filtration tab does not properly sanitize input, allowing for PHP code injection. Furthermore, the plugin fails to restrict the file extension of the generated feed file during the save request, enabling an attacker to change the extension to '.php'. An attacker with Shop Manager or higher privileges can exploit this by injecting a PHP payload, intercepting the save request to change the file extension, and then accessing the generated file to execute arbitrary commands. The vulnerability also supports path traversal, allowing the attacker to move the malicious file to directories where PHP execution is permitted.
Affected products
- Yandex Market YML for Yandex Market < 5.0.26
Timeline
- 2025-03-12: other: Vulnerability added to WPScan database
- 2025-03-19: disclosed: Public disclosure by WPScan
- 2025-04-10: advisory: NVD publication date