CVE-2026-3576

Name of the Vulnerable Software and Affected Versions Planyo Online Reservation System plugin for WordPress versions prior to 3.1

Description An unauthenticated Server-Side Request Forgery (SSRF) exists that leads to Local File Inclusion (LFI). The ulap.php file functions as an AJAX proxy and is accessible without authentication. The send http post() function checks the host of a provided URL against an allowlist containing 'localhost' but does not validate the URL scheme. This allows an attacker to use the file:// protocol to bypass the host check, as parse url() identifies the host as 'localhost'. The URL is then processed by curl init() or fopen(), enabling the reading of arbitrary local files such as /etc/passwd and wp-config.php via the HTTP response.

Recommendations Update the Planyo Online Reservation System plugin for WordPress to a version newer than 3.0. As a temporary mitigation, restrict access to the ulap.php file.