Add WordPress Planyo plugin unauthenticated LFI module (CVE-2026-3576) - #21769
Open
anirbala98 wants to merge 9 commits into
Open
Add WordPress Planyo plugin unauthenticated LFI module (CVE-2026-3576)#21769anirbala98 wants to merge 9 commits into
anirbala98 wants to merge 9 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an auxiliary module for exploiting CVE-2026-3576 in vulnerable Planyo WordPress plugins.
Changes:
- Adds version detection and arbitrary local file retrieval.
- Documents Docker setup and verification.
Impact Analysis: isolated change; no meaningful downstream impact identified from diff. (type "custom")
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
modules/auxiliary/gather/wp_planyo_lfi_cve_2026_3576.rb |
Implements detection and file retrieval. |
documentation/modules/auxiliary/gather/wp_planyo_lfi_cve_2026_3576.md |
Documents setup, options, and usage. |
Suppressed comments (2)
modules/auxiliary/gather/wp_planyo_lfi_cve_2026_3576.rb:102
- Important: Problem: only
Safeis handled, so a changelog request returningUnknownfalls through to “Vulnerable version” and performs the file-read request. Impact: connection failures or non-200 responses become false-positive vulnerability results. Fix: proceed only forAppearsand stop or propagate every otherCheckCode.
changelog_code = check_plugin_version_from_changelog('3.0')
if changelog_code == Msf::Exploit::CheckCode::Safe
print_good("Plugin found: #{changelog_code.details}")
print_error('This version of plugin is not vulnerable')
return
end
modules/auxiliary/gather/wp_planyo_lfi_cve_2026_3576.rb:90
- Important: Problem: this message tells users to override the check, but the module neither prepends
AutoChecknor registers any override option, and this branch always returns. Impact: users cannot run the module when version detection is inconclusive. Fix: expose the logic throughcheckwithMsf::Exploit::Remote::AutoCheck(or register and honor an explicit bypass option).
if readme_code == Msf::Exploit::CheckCode::Unknown
print_error('Plugin\'s version could not be found. Try overriding vulnerability check')
return
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
anirbala98
force-pushed
the
cve-2026-3576-lfi
branch
from
August 22, 2026 04:15
fa4d57b to
bc2554c
Compare
Author
|
Hi @jheysel-r7, I have addressed Copilot's comments and pushed the fixes. The updates are ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This module exploits CVE-2026-3576, a local file inclusion vulnerability via server side request forgery in WordPress's Planyo Online Reservation System plugin(versions < 3.1). The plugin's AJAX proxy ulap.php does not validate the scheme of URLs supplied to it. This allows unauthenticated attackers to supply file:// URLs to ulap.php and retrieve any arbitrary local file contents from the target.
Breaking Changes
None
Reviewer Notes
Prior to version 3.1, the readme.txt file of the plugin does not mention the version in Stable Tag or Version headers. Instead, the version can be identified by looking at the last version mentioned in the Changelog section of readme.txt. Since check_plugin_version_from_readme() supports only Version and Stable Tag headers, I have implemented a check_plugin_version_from_changelog() function to scan the changelog section of readme.txt and retrieve current version.
Verification Steps
docker-compose.ymlis given in the module documentation)msfconsoleand typeuse auxiliary/gather/wp_planyo_lfi_cve_2026_3576set RHOSTS,set RPORTandset TARGETURIrun. It should identify that the plugin version is vulnerable and save the contents of the arbitrary file locallyTest Evidence
The module was tested with Wordpress 7.0.2(docker image) and Planyo Online Reservation plugin 2.9 and 3.1. For version 2.9, the module correctly identified the version as vulnerable and locally saved the contents of target's
/etc/passwdfile. For version 3.1, the module correctly identified the version as not vulnerable.Planyo Online Reservation System plugin 2.9
Planyo Online Reservation System plugin 3.1
Environment
AI Usage Disclosure
ChatGPT was used to help with check_plugin_version_from_changelog() helper function. The code was manually validated and modified accordingly by the author.
Pre-Submission Checklist
documentation/modules