EUVD-2026-43137
GHSA-jjq9-3x6f-75pj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Arbitrary local file disclosure in the Planyo Online Reservation System WordPress plugin (all versions through 3.0) lets unauthenticated remote attackers read any server-side file. The ulap.php AJAX proxy is reachable without WordPress bootstrapping or authentication and validates only the URL host against an allowlist, not the scheme, so a file://localhost/ URL passes the check and is fetched via curl/fopen. Reported by Wordfence with no public exploit identified at time of analysis; sensitive targets include wp-config.php database credentials and /etc/passwd.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Planyo Online Reservation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.
Articles & Coverage 3
Executive ViewAI
The Planyo Online Reservation System WordPress plugin (versions 3.0 and earlier) allows unauthenticated attackers to read any server file from the internet without logging in, including database passwords and configuration data. Organizations running this plugin risk immediate exposure of customer data and database credentials that enable complete system compromise. This vulnerability bypasses all standard WordPress access controls and requires emergency mitigation on all affected deployments.
Within 24 hours: Identify all WordPress instances using Planyo plugin ≤3.0 and review server logs for evidence of file-access exploitation (search for requests to ulap.php AJAX endpoint and file:// URL schemes). Within 7 days: Disable the Planyo plugin immediately; implement WAF rules to block access to /wp-admin/ajax.php?action=ulap parameters; restrict network access to WordPress administrator interfaces to VPN or internal IP ranges only. Within 30 days: Uninstall the plugin completely; rotate all database credentials; if Planyo functionality is business-critical, contact the vendor regarding patch availability or conduct security evaluation of alternative plugins.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable and uninstall the plugin; (2) Block all requests to ulap.php via WAF or web server configuration; (3) Restrict WordPress backend access via IP allowlisting or VPN requirement; (4) Apply filesystem permissions to deny web server read access to wp-config.php outside the WordPress application itself; (5) Increase monitoring frequency on database access logs and web server error logs for suspicious queries; (6) Force password reset for all database user accounts as precaution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.