Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576)

This module exploits a Server Side Request Forgery SSRF vulnerability in Wordpress's Planyo Online Reservation System v3.0 or less. The plugin's AJAX proxy ulap.php does not require authentication and does not validate URL scheme supplied via ulapurl parameter. This allows unauthenticated attacke...