The YML for Yandex Market WordPress plugin prior to version 5.0.26 contains a vulnerability classified as CWE-94 (Improper Control of Generation of Code), which enables remote code execution via the feed generation process. This vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects the plugin's handling of YML feed generation, potentially allowing an attacker to inject and execute arbitrary code remotely. There is no vendor advisory or patch information currently available, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system during the feed generation process. This impacts the confidentiality and integrity of the system but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the plugin vendor and consider disabling or restricting access to the feed generation functionality if feasible to reduce exposure.