CVE-2026-3576

Name: CVE-2026-3576 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-3576

HIGH

CVSS v3.1: 7.2 · EPSS: 0.0029 (20.7 percentile)

NetworkNo privilegesNo user interactionImproper Input Validation

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: HIGH
CVSS: 7.2 v3.1 · NVD
EPSS: 0.0029 (20.7 percentile) · FIRST.org
CISA KEV: No
Type: Improper Input Validation · NVD CWE
Attack conditions (CVSS vector): NetworkNo privilegesNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 7.2 / 10 HIGH Source: NVD

EPSS 0.0029 20.7 percentile Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database credentials and authentication keys), and other server-side files.

Record details

CVE ID: CVE-2026-3576
CVSS (v3.1): 7.2 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Exploitability subscore: 3.9
Impact subscore: 2.7
EPSS: 0.0029 (20.7 percentile) — 2026-07-12
CISA KEV: No
Weakness (CWE): CWE-20
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

← Back to all records