CVE-2025-14545

The YML for Yandex Market WordPress plugin versions prior to 5.0.26 contains a remote code execution vulnerability in its feed generation process that allows unauthenticated attackers to execute arbitrary code on affected systems. This vulnerability affects WordPress installations utilizing the vulnerable plugin version. The vulnerability has a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and no user interaction or authentication. While the attack could potentially compromise system confidentiality and integrity, the overall impact remains moderate given the medium severity rating. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities (KEV) catalog and inactive status on threat tracking lists. The extremely low EPSS score of 0.001040 suggests minimal real-world exploitation activity, though administrators should still apply the available patch to version 5.0.26 or later as a precautionary measure.