Junglewise Threat Intelligence

CVE-2026-3576: Xtreeme Planyo Online Reservation System SSRF and LFI in ulap.php

CVE-2026-3576 · Severity: high · CVSS 7.2 · Published 2026-07-11

Executive brief

The Planyo Online Reservation System plugin for WordPress, which manages online bookings, contains a security flaw that allows unauthorized individuals to view sensitive files on the web server. By exploiting this vulnerability, an attacker could steal database credentials, configuration files, or other private system information. This could lead to a full compromise of the website and its underlying data.

Technical details

The vulnerability exists in the ulap.php file, which acts as an unauthenticated AJAX proxy. The send_http_post() function validates the host of a user-provided URL against an allowlist containing 'localhost' but fails to validate the URL scheme. An attacker can use the file:// protocol (e.g., file://localhost/etc/passwd) to bypass the host check, as parse_url() identifies the host as 'localhost'. The URL is then processed by curl_init() or fopen(), enabling the retrieval of arbitrary local files. This results in the disclosure of sensitive information such as database credentials and authentication keys.

Affected products

  • Xtreeme Planyo Online Reservation System up to, and including, 3.0

Timeline

  • 2026-07-11: advisory: NVD publication date

References