Planyo Online Reservation System <= 3.0 - Arbitrary File Read
CVE-2026-3576
Verified
Description
The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The send_http_post() function validates the host of the supplied URL against an allowlist that includes localhost, but never validates the URL scheme, so a file://localhost/ URL passes the host check and is handed to curl_init() or fopen(). Both support the file:// wrapper, so the contents of arbitrary local files are returned in the response.
Severity
High
CVSS Score
7.2
Exploit Probability
9%
Affected Product
planyo-online-reservation-system
Published Date
August 16, 2026
Template Author
aryu-ru
CVE-2026-3576.yaml
7.2Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-3576
CWE ID:
cwe-20
Remediation Steps
Update the Planyo Online Reservation System plugin to version 3.1 or later, which rejects any URL scheme other than http and https.