Constellation · CASCA

Constellation explorer

Every signal has a story.Follow the evidence.

Return to triage

Find a CVE by identifier or text

↵ select

Minimum eligible CVSSOrderKEV only

Start with evidence

Current exploration

CVE-2026-3576

Your trail

Where next?

CVE-2026-3576

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that includes 'localhost', but critically fails to validate the URL scheme/protocol. This makes it possible for unauthenticated attackers to supply a file:// URL (e.g., file://localhost/etc/passwd) which bypasses the host allowlist check because parse_url() returns 'localhost' as the host. The URL is then passed to curl_init() or fopen(), both of which support the file:// protocol, allowing the attacker to read arbitrary local files on the server and have their contents returned in the HTTP response. This can lead to disclosure of sensitive files such as /etc/passwd, wp-config.php (containing database c

1 retained evidence references · snapshot-bound · open authoritative view

StateSource-scoped evidence

Priority25.2–67.8

Coverage45.0%

Connections1

Choose an action.

Evidence state

identity unresolved
known present
not listed in bounded source
evidence unknown

Snapshot-bound reason tuple

Unlisted at snapshot cutofffactor_a_kev

The item is not listed in the bounded source as of the stated cutoff; this does not establish safety or absence outside that source.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Monitor bounded source

Evidence supportedfactor_b_epss

Eligible evidence is present for this bounded claim.

Revision: evidence-policy-v1.1.0
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Evidence supportedfactor_c_cvss

Eligible evidence is present for this bounded claim.

Revision: casca-direct-cvss-eligibility-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: None

Source-reported scopefactor_d_breadth

The source assertion is retained, but its canonical identity is unresolved.

Revision: casca-factor-d-obligations-v1
Cutoff: 2026-08-27T18:09:02.177Z
Resolution: Resolve identity

Connections 1

has cited scope1 retained · stored CVE-2026-3576 → xtreeme · Planyo online reservation system

88c53f0d-6a60-4059-b70f-f228aa18a676

CVEProductSignalSelected / traceVisual proximity carries zero evidence weight.