Chaeyp

**Name of the Vulnerable Software and Affected Versions** Planyo Online Reservation System plugin for WordPress versions prior to 3.1 **Description** An unauthenticated Server-Side Request Forgery (SSRF) exists that leads to Local File Inclusion (LFI). The `ulap.php` file functions as an AJAX proxy and is accessible without authentication. The `send http post()` function checks the host of a provided URL against an allowlist containing 'localhost' but does not validate the URL scheme. This allows an attacker to use the `file://` protocol to bypass the host check, as `parse url()` identifies the host as 'localhost'. The URL is then processed by `curl init()` or `fopen()`, enabling the reading of arbitrary local files such as `/etc/passwd` and `wp-config.php` via the HTTP response. **Recommendations** Update the Planyo Online Reservation System plugin for WordPress to a version newer than 3.0. As a temporary mitigation, restrict access to the `ulap.php` file.