YML for Yandex Market Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the YML for Yandex Market WordPress plugin, affecting versions prior to 5.3.0. This vulnerability allows for improper limitation of a pathname, which could be exploited to delete arbitrary files from the website. Such file deletion could disrupt the site's functionality, especially if core files are removed.

Impact

Exploitation of this vulnerability could lead to arbitrary file deletion on the affected WordPress site. This could cause significant disruption, particularly if essential core files are deleted, potentially breaking the site's functionality.

Remediation

Users of the YML for Yandex Market WordPress plugin should update to version 5.3.0 or later. Patchstack users can enable auto-update for vulnerable plugins.