The vulnerability in the YML for Yandex Market WordPress plugin allows an attacker to trigger arbitrary code execution during the feed generation process. By exploiting this flaw, adversaries can run any commands on the underlying server, potentially compromising confidentiality, integrity, and availability of the entire website. The severity score of 6.5 indicates a moderate risk if the vulnerability is leveraged.

WordPress installations that use the YML for Yandex Market plugin, specifically any deployment running a version older than 5.0.26. The vendor is currently unknown, but affected sites are those that have this plugin installed and are serving market feeds.

With a CVSS score of 6.5 and an EPSS below 1%, the likelihood of successful exploitation is considered low at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is remotely reachable through the web interface that initiates feed creation. Because the exploit requires no prior local access, attackers can target the plugin from anywhere with internet access.