CVE-2026-3576 is an SSRF vulnerability in the Planyo Online Reservation System WordPress plugin affecting all versions up to 3.0. The ulap.php file acts as an unauthenticated AJAX proxy that uses the send_http_post() function to validate the host of a supplied URL against an allowlist including 'localhost'. However, it does not validate the URL scheme, allowing attackers to supply file:// URLs. Because parse_url() returns 'localhost' as the host for such URLs, the host allowlist check is bypassed. The URL is then passed to curl_init() or fopen(), which support file://, enabling arbitrary local file inclusion and disclosure of sensitive files on the server.

An unauthenticated attacker can exploit this vulnerability to read arbitrary local files on the server hosting the Planyo plugin. This can lead to disclosure of sensitive information such as system password files (/etc/passwd) and WordPress configuration files (wp-config.php) containing database credentials and authentication keys. The vulnerability does not allow code execution or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ulap.php file and consider disabling the plugin if possible. Monitor for updates from the vendor xtreeme regarding patches or official mitigations.