The YML for Yandex Market plugin exposes the merchant’s plaintext Yandex Market API key by writing it to a publicly accessible log file. The flaw is triggered by the 'y4ym_check_action' parameter in admin-post.php. Because the log file resides in the web‑root, unauthenticated users can download it, gaining control over the merchant’s catalogue, prices, and stock. This vulnerability is a classic case of logging sensitive information and is classified as CWE‑532.

The vulnerability affects the WordPress plugin "YML for Yandex Market" from vendor icopydoc in all releases up to and including version 5.10.0. Users running these versions are at risk if the plugin’s keep‑logs option is enabled, which is recommended by the plugin’s documentation.

With a CVSS score of 5.3 the flaw is considered moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the plugin be installed, a Yandex Market API key be stored, and the keep‑logs setting be enabled—a configuration that normal usage encourages. The likely attack vector is an unauthenticated HTTP access to the publicly readable log file located at wp-content/uploads/y4ym/yml-for-yandex-market.log. Given these conditions, the likelihood of successful exploitation is significant for affected sites, and the impact is high because the exposed key grants full control over the merchant’s marketplace.