What is the CVSS score of CVE-2026-3576?

CVE-2026-3576 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2026-3576?

The Planyo Online Reservation System WordPress plugin (versions 3.0 and earlier) allows unauthenticated attackers to read any server file from the internet without logging in, including database…

Is there a public PoC exploit available for CVE-2026-3576?

Yes, a public proof-of-concept exploit is available for CVE-2026-3576. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-3576?

Within 24 hours: Identify all WordPress instances using Planyo plugin ≤3.0 and review server logs for evidence of file-access exploitation (search for requests to ulap.php AJAX endpoint and file:// URL schemes). Within 7 days: Disable the Planyo plugin immediately; implement WAF rules to block access to /wp-admin/ajax.php?action=ulap parameters; restrict network access to WordPress administrator interfaces to VPN or internal IP ranges only. Within 30 days: Uninstall the plugin completely; rotate all database credentials; if Planyo functionality is business-critical, contact the vendor regarding patch availability or conduct security evaluation of alternative plugins.

PHP CVE-2026-3576

EUVD-2026-43137 HIGH

Improper Input Validation (CWE-20)

2026-07-11 Wordfence

GHSA-jjq9-3x6f-75pj

PHP WordPress SSRF Wordpress Plugin Planyo Online Reservation System

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 05:03 vuln.today

CVE Published

Jul 11, 2026 - 03:44 cve.org

HIGH 7.2

DescriptionCVE.org

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.

Articles & Coverage 3

anirbala98.medium.com From Source Code to Exploit: Understanding CVE-2026–3576 Jul 28, 2026 News 3 New PHP Vulnerabilities - 3 High Severity Patched Jul 12, 2026 News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Arbitrary local file disclosure in the Planyo Online Reservation System WordPress plugin (all versions through 3.0) lets unauthenticated remote attackers read any server-side file. The ulap.php AJAX proxy is reachable without WordPress bootstrapping or authentication and validates only the URL host against an allowlist, not the scheme, so a file://localhost/ URL passes the check and is fetched via curl/fopen. Reported by Wordfence with no public exploit identified at time of analysis; sensitive targets include wp-config.php database credentials and /etc/passwd.