CVE-2026-3576: Planyo Online Reservation SSRF Vulnerability

CVE-2026-3576 Overview

CVE-2026-3576 is a Server-Side Request Forgery (SSRF) vulnerability leading to Local File Inclusion (LFI) in the Planyo Online Reservation System plugin for WordPress. The flaw affects all versions up to and including 3.0. The ulap.php file acts as an AJAX proxy that is directly accessible without WordPress bootstrapping or authentication. Unauthenticated attackers can supply a file:// URL to bypass an incomplete host allowlist, causing the server to read arbitrary local files and return their contents in the HTTP response. This vulnerability is classified under [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated attackers can read sensitive server files including /etc/passwd and wp-config.php, disclosing database credentials and authentication keys.

Affected Products

Planyo Online Reservation System plugin for WordPress — all versions up to and including 3.0
Vulnerable component: ulap.php AJAX proxy
Vulnerable function: send_http_post()

Discovery Timeline

2026-07-11 - CVE-2026-3576 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-3576

Vulnerability Analysis

The Planyo Online Reservation System plugin exposes ulap.php as a directly accessible AJAX proxy. The file loads without WordPress bootstrapping and enforces no authentication. Any unauthenticated attacker on the network can invoke it and pass arbitrary URLs to the internal send_http_post() function. That function is intended to relay requests to trusted hosts, but the implementation performs incomplete input validation.

The send_http_post() function validates only the host component of the provided URL against an allowlist containing values such as localhost. It does not validate the URL scheme or protocol. Because PHP's parse_url() returns localhost as the host for a URL like file://localhost/etc/passwd, the allowlist check succeeds for filesystem paths.

The validated URL is then passed to curl_init() or fopen(). Both functions support the file:// protocol wrapper, causing them to read the referenced local file. The file contents are returned in the HTTP response body, converting the SSRF primitive into an LFI read primitive.

Root Cause

The root cause is missing scheme validation in send_http_post(). The allowlist enforces host matching but does not restrict acceptable URL protocols to http or https. Combined with unauthenticated access to ulap.php, this permits filesystem reads through PHP stream wrappers.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to ulap.php on a WordPress site running the vulnerable plugin. The attacker supplies a file://localhost/<path> URL as the target parameter. The proxy fetches the file through curl or fopen and returns the contents. Attackers commonly target /etc/passwd, wp-config.php, private keys, and application logs to escalate access.

No exploitation code is described in the enriched data. See the Wordfence Vulnerability Report and the vulnerable WordPress Plugin Code Snippet for technical details.

Detection Methods for CVE-2026-3576

Indicators of Compromise

HTTP requests to /wp-content/plugins/planyo-online-reservation-system/ulap.php from unauthenticated sources.
Request parameters containing the file:// scheme, particularly file://localhost/ prefixes.
Response bodies from ulap.php returning contents resembling /etc/passwd, wp-config.php, or other server-side configuration files.
Web server access logs showing repeated probing of ulap.php with varied path traversal payloads.

Detection Strategies

Deploy web application firewall rules that block requests to ulap.php containing file://, php://, or similar stream wrapper schemes in any parameter.
Alert on outbound responses from WordPress hosts that contain patterns typical of /etc/passwd (root:x:0:0) or WordPress secrets (DB_PASSWORD, AUTH_KEY).
Correlate unauthenticated access to plugin PHP endpoints with unusual response sizes indicating file dumps.

Monitoring Recommendations

Enable verbose logging of query strings and POST bodies for wp-content/plugins/ endpoints.
Monitor file access telemetry on the web server for reads of wp-config.php and /etc/passwd initiated by the PHP worker process.
Track WordPress plugin inventory and flag hosts running Planyo Online Reservation System version 3.0 or earlier.

How to Mitigate CVE-2026-3576

Immediate Actions Required

Deactivate and remove the Planyo Online Reservation System plugin until a patched release is confirmed installed.
Rotate any credentials that may have been exposed through wp-config.php, including database passwords, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values.
Restrict direct HTTP access to ulap.php at the web server or WAF layer.
Review web server access logs for prior requests to ulap.php containing file:// payloads.

Patch Information

A plugin update is referenced in the WordPress Change Set Update. Administrators should upgrade Planyo Online Reservation System to a version later than 3.0 that includes scheme validation in send_http_post(). Consult the Wordfence Vulnerability Report for the fixed version confirmation.

Workarounds

Block requests to /wp-content/plugins/planyo-online-reservation-system/ulap.php at the web server or WAF until patched.
Disable PHP allow_url_fopen if not required, and configure open_basedir to restrict filesystem access to the WordPress document root.
Deny the file:// stream wrapper in PHP by setting disable_functions and hardening php.ini where feasible.

bash

# Configuration example: block direct access to ulap.php in nginx
location ~* /wp-content/plugins/planyo-online-reservation-system/ulap\.php$ {
    deny all;
    return 403;
}

# php.ini hardening
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"