Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter
Strategic Overview
- Status
- Patched in 3.1
- Affected Plugin
- Planyo online reservation system
- Affected Version
<= 3.0- CVSS
- 7.2High
- Weakness type
- CWE-20 · Improper Input Validation
- CVE
CVE-2026-3576
At a glance
CVE-2026-3576 is a high-severity Improper Input Validation vulnerability in the Planyo online reservation system WordPress plugin, affecting versions <= 3.0. It carries a CVSS score of 7.2 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.1; sites on affected versions should update now. Disclosed July 2026, reported by chaeyp.
Vulnerability Overview
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-20: Improper Input Validation
Planyo online reservation system <= 3.0 carries this weakness at localhost, and reaching it takes no account at all. Improper input validation means the application accepts input without confirming it has the form, type or range the code downstream assumes.
The concrete impact depends on where the unvalidated value lands, which is why records in this class range from cosmetic bugs to full compromise. For Planyo online reservation system the fix is 3.1: builds <= 3.0 are affected, anything from 3.1 onward is not.
Remediation
Update to version 3.1, or a newer patched version
How does WordSec protect against this?
Requests carrying this pattern arrive without a session, so nothing upstream of the firewall gets a chance to reject them: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Planyo online reservation system 3.1 closes this, and updating the plugin is the step that ends it.
- Firewall
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in Planyo online reservation system
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C