CVE-2026-3576 json
Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
published 2026-07-11 3 mo ago modified 2026-07-13 3 mo ago also EUVD-2026-43137
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.8%
- EPSS 8.8% chance of exploitation in 30 days, percentile 95%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.
Timeline
- First public exploit (Metasploit auxiliary/gather/wp_planyo_lfi_cve_2026_3576)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
8.81% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/wp_planyo_lfi_cve_2026_3576 Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576) metasploit auxiliary, normal rank, 2026-07-10
- EDB-52636 Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF webapps, 2026-08-11
- Nuclei template Planyo Online Reservation System <= 3.0 - Arbitrary File Read nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected products
- xtreeme Planyo online reservation system
Classification
- Weakness
-
- CWE-20 Improper Input Validation
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=cve
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/trunk/ulap.php#L84
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/tags/2.7/ulap.php#L84
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/trunk/ulap.php#L96
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/tags/2.7/ulap.php#L96
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/trunk/ulap.php#L59
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/tags/2.7/ulap.php#L59
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/trunk/ulap.php#L120
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/tags/2.7/ulap.php#L120
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/trunk/ulap.php#L118
- plugins.trac.wordpress.org /browser/planyo-online-reservation-system/tags/2.7/ulap.php#L118
- plugins.trac.wordpress.org /changeset?reponame=&old=3488647%40planyo-online-reservation-system&new=3488647%40planyo-online-reservation-sy
Sources
- CVE List CVE-2026-3576
- NVD CVE-2026-3576
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.