The YML for Yandex Market WordPress plugin versions earlier than 5.0.26 contains a flaw that allows attackers to execute arbitrary code during the feed generation process. This vulnerability can compromise the confidentiality, integrity, and availability of the affected WordPress site by enabling full control over the server. It is a classic remote code execution weakness that can be leveraged by an attacker with sufficient access to invoke the feed creation function.

Any WordPress installation running the YML for Yandex Market plugin prior to version 5.0.26 is potentially affected. The plugin is developed by Unknown:YML for Yandex Market and is used for managing market feeds for Yandex Market sellers.

The CVSS score is not provided, but the nature of the vulnerability suggests a high or critical severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is via the WordPress admin interface that triggers feed generation, and an attacker may need to be authenticated as an administrator or have sufficient privileges to access that functionality. Even in more restricted environments, the flaw remains exploitable if the feed generation API can be called by untrusted input.