The Planyo Online Reservation System plugin for WordPress contains an AJAX proxy endpoint in ulap.php that can be accessed without user authentication. This vulnerability is a classic input validation flaw marked as CWE-20. The function send_http_post() verifies only the host against an allowlist that includes "localhost", yet it ignores can supply a file:// URL such as file://localhost/etc/passwd; the parsing logic treats the host as "localhost", allowing the request to pass the host check. The URL is passed to curl_init() or fopen(), both of these support file://, causing the plugin to read the requested local file and return its contents in the HTTP response. This flaw enables unauthenticated users to read arbitrary server files, including /etc/passwd, wp-config.php, and other sensitive configuration files.

The vulnerability is present in the xtreeme:Planyo online reservation system plugin for WordPress, affecting all releases version 3.0 and earlier. Any site running these versions is considered vulnerable, with no further sub‑version detail provided.

7.2 indicates a high risk of information disclosure. The EPSS score is below 1%, suggesting that the likelihood of exploitation is currently very low, although no guarantees exist. The flaw is not listed in CISA's KEV catalog, so no publicly known exploit is available. The most probable attack vector is an unauthenticated HTTP request to ulap.php containing a file:// URL, which can be crafted from any browser or network. An attacker can read any file accessible to the web server process, potentially leaking database credentials, session salts, or passwords, thereby compromising confidentiality but not achieving code execution.