CVE-2025-14545: RCE in YML for Yandex Market

Successful exploitation of CVE-2025-14545 could allow an attacker to gain complete control over the WordPress server hosting the vulnerable plugin. This could lead to data breaches, website defacement, malware installation, and further compromise of the entire network. The attacker's ability to execute arbitrary code means they can perform virtually any action they desire on the server, including accessing sensitive data, modifying configurations, and installing backdoors for persistent access. The impact is particularly severe given the widespread use of WordPress and the potential for large-scale compromise if the vulnerability is exploited.

1. Reserved2025-12-11
2. Published2026-03-19
3. Modified2026-04-15
4. EPSS updated2026-04-17

The primary mitigation for CVE-2025-14545 is to immediately upgrade the YML for Yandex Market plugin to version 5.0.26 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider restricting access to the plugin's administrative interface to only trusted users. While not a complete solution, this can limit the potential attack surface. Review user roles and permissions to ensure that only necessary privileges are granted. Monitor WordPress logs for any suspicious activity related to the plugin, such as unexpected code execution attempts.

Active installs

10KKnown

Plugin rating

4.8

Requires WordPress

5.9+

Compatible up to

6.9.4

Requires PHP

7.4.0+