{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14545", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2025-12-11T15:36:38.497Z", "datePublished": "2026-04-10T06:00:13.825Z", "dateUpdated": "2026-04-10T06:00:13.825Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-04-10T06:00:13.825Z"}, "title": "YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation", "problemTypes": [{"descriptions": [{"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "YML for Yandex Market", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "5.0.26"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process."}], "references": [{"url": "https://wpscan.com/vulnerability/9bb1a4ca-976c-461d-82de-8a3b04a56fbc/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Alex Tselevich (nos3curity)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The YML for Yandex Market WordPress plugin before 5.0.26 is vulnerable to Remote Code Execution via the feed generation process."}], "id": "CVE-2025-14545", "lastModified": "2026-04-10T07:16:19.607", "metrics": {}, "published": "2026-04-10T07:16:19.607", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/9bb1a4ca-976c-461d-82de-8a3b04a56fbc/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.0.26)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "YML for Yandex Market", "source": "cna", "vendor": "Unknown"}, "product": "yml_for_yandex_market", "vendor": "icopydoc"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-10T07:21:24.712692+00:00", "value": {"mitigation_remediation": ["Update the YML for Yandex Market plugin to version 5.0.26 or newer", "Disable or restrict access to the feed generation feature until a patch is applied", "Verify that no untrusted data is passed to the feed generation process", "Review server logs for suspicious activity related to feed generation", "Consider applying a temporary firewall rule to block the feed generation endpoint if immediate patching is not possible"], "summary": {"action": "Update Plugin", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Any WordPress installation running the YML for Yandex Market plugin prior to version 5.0.26 is potentially affected. The plugin is developed by Unknown:YML for Yandex Market and is used for managing market feeds for Yandex Market sellers.", "description_and_impact": "The YML for Yandex Market WordPress plugin versions earlier than 5.0.26 contains a flaw that allows attackers to execute arbitrary code during the feed generation process. This vulnerability can compromise the confidentiality, integrity, and availability of the affected WordPress site by enabling full control over the server. It is a classic remote code execution weakness that can be leveraged by an attacker with sufficient access to invoke the feed creation function.", "risk_and_exploitability": "The CVSS score is not provided, but the nature of the vulnerability suggests a high or critical severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is via the WordPress admin interface that triggers feed generation, and an attacker may need to be authenticated as an administrator or have sufficient privileges to access that functionality. Even in more restricted environments, the flaw remains exploitable if the feed generation API can be called by untrusted input."}}}}, "created": "2026-04-10T08:35:36.389492+00:00", "updated": "2026-04-10T09:26:37.765579+00:00", "vendors": ["icopydoc", "icopydoc$PRODUCT$yml_for_yandex_market", "wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-94"]}