Planyo WordPress Plugin Unauthenticated SSRF Leading to Local File Inclusion via 'ulap_url' (CVE-2026-3576)

Vulnerability Overview Vulnerability Name: Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter CVE ID: CVE-2026-3576 CVSS Score: 7.2 (High) Publication Date: July 10, 2026 Last Updated: July 11, 2026 Researchers: - chaewon - Reconix - Romnachai Sretawat Na Ayutaya (Simonhektai) - Reconix Co., Ltd. - Romnachai Chagpa (nnr) - Reconix Co., Ltd. Impact Scope Affected Versions: <= 3.0 Software Type: Plugin Software Name: Planyo online reservation system Software Link: view on wordpress.org Remediation Recommendation: Upgrade to version 3.1 or later of the patched release. Vulnerability Description The Planyo Online Reservation System plugin for WordPress contains a server-side request forgery vulnerability leading to local file inclusion, affecting all versions up to 3.0. The file can be accessed directly as an AJAX proxy without requiring WordPress initialization or any authentication. While the function validates the host of the provided URL, it fails to properly validate the URL scheme/protocol. This allows attackers to inject URLs (e.g., ), bypassing the host whitelist check. Since both and support the protocol, attackers can read arbitrary local files on the server and have their contents returned in the HTTP response, potentially leading to the leakage of sensitive files such as or , thereby exposing database credentials and authentication keys. References plugins.trac.wordpress.org Sharing Options Facebook Twitter LinkedIn Email Additional Information Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Contact: For errors or more information, please contact . Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Support Services: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription: Subscribe to news and updates, and get vulnerability database information via the Wordfence Intelligence WordPress plugin. Copyright Statement © 2012-2026 Defiant Inc. All Rights Reserved Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook LinkedIn Instagram Subscription Form Enter your email address to subscribe to news and updates. Check the box to agree to the terms of service and privacy policy. Click the "SIGN UP" button to complete the subscription. Additional Information Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Contact: For errors or more information, please contact . Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Support Services: Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription: Subscribe to news and updates, and get vulnerability database information via the Wordfence Intelligence WordPress plugin. Copyright Statement © 2012-2026 Defiant Inc. All Rights Reserved Additional Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media X (Twitter) Facebook LinkedIn Instagram Subscription Form Enter your email address to subscribe to news and updates. Check the box to agree to the terms of service and privacy policy. Click the "SIGN UP" button to complete the subscription.

Goal Reached Thanks to every supporter — we hit 100%!

Planyo WordPress Plugin Unauthenticated SSRF Leading to Local File Inclusion via 'ulap_url' (CVE-2026-3576)