{"id":224,"date":"2026-08-20T17:39:36","date_gmt":"2026-08-20T15:39:36","guid":{"rendered":"https:\/\/helloblog.io\/cs\/elementor-pro-opravuje-kritickou-chybu-nahrani-souboru\/"},"modified":"2026-08-20T17:39:36","modified_gmt":"2026-08-20T15:39:36","slug":"elementor-pro-opravuje-kritickou-chybu-nahrani-souboru","status":"publish","type":"post","link":"https:\/\/helloblog.io\/cs\/elementor-pro-opravuje-kritickou-chybu-nahrani-souboru\/","title":{"rendered":"Elementor Pro opravuje kritickou chybu pro nahr\u00e1n\u00ed libovoln\u00e9ho souboru"},"content":{"rendered":"\n<p>Elementor Pro opravuje kritickou zranitelnost, kter\u00e1 umo\u017e\u0148ovala nep\u0159ihl\u00e1\u0161en\u00e9mu \u00fato\u010dn\u00edkovi nahr\u00e1t na web libovoln\u00fd soubor v\u010detn\u011b spustiteln\u00e9ho PHP. Chyba zasahuje v\u0161echny verze do 4.2.1 v\u010detn\u011b a dostala identifik\u00e1tor <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\">CVE-2026-32475<\/a>. Aktualizuj na Elementor Pro 4.2.2 nebo nov\u011bj\u0161\u00ed co nejd\u0159\u00edv.<\/p>\n\n\n\n<p>Probl\u00e9m se t\u00fdk\u00e1 web\u016f, kter\u00e9 maj\u00ed zve\u0159ejn\u011bnou str\u00e1nku s formul\u00e1\u0159ov\u00fdm widgetem Form z Elementor Pro. Formul\u00e1\u0159 mus\u00ed obsahovat alespo\u0148 jedno <strong>nepovinn\u00e9<\/strong> pole pro nahr\u00e1n\u00ed souboru (File Upload). \u00dato\u010dn\u00edk se nemus\u00ed p\u0159ihla\u0161ovat, tak\u017ee zve\u0159ejn\u011bn\u00fd formul\u00e1\u0159 sta\u010d\u00ed jako vstupn\u00ed bod.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Kritick\u00e1 zranitelnost<\/h4>\n\n\n<p>CVE-2026-32475 m\u00e1 sk\u00f3re CVSS 9,8 z 10. \u00dasp\u011b\u0161n\u00fd \u00fatok m\u016f\u017ee v\u00e9st ke vzd\u00e1len\u00e9mu spu\u0161t\u011bn\u00ed k\u00f3du a \u00fapln\u00e9mu p\u0159evzet\u00ed webu.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Koho chyba zasahuje a co ud\u011blat<\/h2>\n\n\n\n<p>Ohro\u017een\u00e9 jsou instalace Elementor Pro ve verzi 4.2.1 a star\u0161\u00ed. Plugin m\u00e1 odhadem 6 000 000 aktivn\u00edch instalac\u00ed. Opraven\u00e1 verze 4.2.2 vy\u0161la 19. srpna 2026.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>V administraci WordPressu otev\u0159i p\u0159ehled plugin\u016f a ov\u011b\u0159 verzi Elementor Pro.<\/li>\n\n\n<li>Pokud pou\u017e\u00edv\u00e1\u0161 verzi 4.2.1 nebo star\u0161\u00ed, aktualizuj plugin alespo\u0148 na verzi 4.2.2.<\/li>\n\n\n<li>Projdi ve\u0159ejn\u00e9 formul\u00e1\u0159e vytvo\u0159en\u00e9 v Elementor Pro, zejm\u00e9na ty s nepovinn\u00fdm polem pro nahr\u00e1n\u00ed souboru.<\/li>\n\n\n<li>Po aktualizaci ov\u011b\u0159, \u017ee formul\u00e1\u0159e a legitimn\u00ed nahr\u00e1v\u00e1n\u00ed soubor\u016f funguj\u00ed podle o\u010dek\u00e1v\u00e1n\u00ed.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Jak obejit\u00ed validace fungovalo<\/h2>\n\n\n\n<p>Elementor Pro zpracov\u00e1v\u00e1 odeslan\u00e9 formul\u00e1\u0159e p\u0159es metodu <code>ajax_send_form()<\/code> ve t\u0159\u00edd\u011b <code>Ajax_Handler<\/code>, kterou mohou volat i nep\u0159ihl\u00e1\u0161en\u00ed n\u00e1v\u0161t\u011bvn\u00edci. Plugin zabal\u00ed data formul\u00e1\u0159e v\u010detn\u011b nahran\u00fdch soubor\u016f do objektu <code>Form_Record<\/code> a p\u0159ed\u00e1 je valida\u010dn\u00edm a zpracovac\u00edm metod\u00e1m t\u0159\u00eddy <code>ElementorProModulesFormsFieldsUpload<\/code>.<\/p>\n\n\n\n<p>P\u0159i validaci nahr\u00e1vky metoda <code>validation()<\/code> nejprve oprav\u00ed indexy soubor\u016f, na\u010dte <code>$_FILES['form_fields']<\/code> a p\u0159\u00edpadn\u011b ov\u011b\u0159\u00ed maxim\u00e1ln\u00ed po\u010det soubor\u016f. Pak proch\u00e1z\u00ed jednotliv\u00e9 polo\u017eky nahr\u00e1vac\u00edho pole. Kritick\u00e1 chyba byla v reakci na pr\u00e1zdnou prvn\u00ed polo\u017eku nepovinn\u00e9ho pole: k\u00f3d pou\u017eil <code>return<\/code>, a t\u00edm ukon\u010dil validaci v\u0161ech dal\u0161\u00edch polo\u017eek.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    \/\/ U nepovinn\u00e9ho pole nebyl v t\u00e9to polo\u017ece nahr\u00e1n soubor.\n    if ( ! $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        return;\n    }\n\n    \/\/ Povinn\u00e9 pole bez souboru vr\u00e1t\u00ed chybu.\n    if ( $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    \/\/ Ostatn\u00ed chyby nahr\u00e1v\u00e1n\u00ed vr\u00e1t\u00ed chybu formul\u00e1\u0159e.\n    if ( $file['error'] &gt; UPLOAD_ERR_OK ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file type is not allowed.', 'elementor-pro' ) );\n    }\n\n    if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file exceeds the maximum allowed size.', 'elementor-pro' ) );\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ U nepovinn\u00e9ho pole nebyl v t\u00e9to polo\u017ece nahr\u00e1n soubor.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Povinn\u00e9 pole bez souboru vr\u00e1t\u00ed chybu.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Ostatn\u00ed chyby nahr\u00e1v\u00e1n\u00ed vr\u00e1t\u00ed chybu formul\u00e1\u0159e.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">><\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_OK<\/span><span style=\"color:#E1E4E8\"> ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Spr\u00e1vn\u011b m\u011bl k\u00f3d pou\u017e\u00edt <code>continue<\/code>. Ten by pr\u00e1zdnou polo\u017eku p\u0159esko\u010dil a pokra\u010doval kontrolou dal\u0161\u00edho souboru. <code>return<\/code> ale metodu okam\u017eit\u011b ukon\u010dil, tak\u017ee se pro zb\u00fdvaj\u00edc\u00ed polo\u017eky nespustila kontrola p\u0159\u00edpony p\u0159es <code>is_file_type_valid()<\/code> ani kontrola velikosti p\u0159es <code>is_file_size_valid()<\/code>.<\/p>\n\n\n\n<p>\u00dato\u010dn\u00edk proto mohl poslat nahr\u00e1vac\u00ed pole jako pole se dv\u011bma \u010d\u00e1stmi. Prvn\u00ed \u010d\u00e1st nechal pr\u00e1zdnou, \u010d\u00edm\u017e vyvolal <code>UPLOAD_ERR_NO_FILE<\/code> a p\u0159ed\u010dasn\u00fd n\u00e1vrat z validace. Do druh\u00e9 \u010d\u00e1sti vlo\u017eil PHP payload a zvolil mu p\u0159\u00edponu, kterou by standardn\u00ed validace odm\u00edtla.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pro\u010d se soubor p\u0159esto ulo\u017eil<\/h2>\n\n\n\n<p>Zpracovac\u00ed metoda <code>process_field()<\/code> se k pr\u00e1zdn\u00e9 polo\u017ece chovala spr\u00e1vn\u011b: pou\u017eila <code>continue<\/code>, nikoli <code>return<\/code>. Prvn\u00ed pr\u00e1zdnou \u010d\u00e1st tedy p\u0159esko\u010dila, ale druhou &#8211; u\u017e neov\u011b\u0159enou &#8211; \u010d\u00e1st zpracovala a ulo\u017eila na disk.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        continue;\n    }\n\n    $uploads_dir = $this-&gt;get_ensure_upload_dir();\n    $file_extension = pathinfo( $file['name'], PATHINFO_EXTENSION );\n    $filename = uniqid() . '.' . $file_extension;\n    $filename = wp_unique_filename( $uploads_dir, $filename );\n    $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n    if ( is_dir( $uploads_dir ) &amp;&amp; is_writable( $uploads_dir ) ) {\n        $move_new_file = Plugin::instance()-&gt;php_api-&gt;move_uploaded_file(\n            $file['tmp_name'],\n            $new_file\n        );\n\n        if ( false !== $move_new_file ) {\n            chmod( $new_file, 0644 );\n            $record-&gt;add_file( $id, $index, [\n                'path' =&gt; $new_file,\n                'url'  =&gt; $this-&gt;get_file_url( $filename ),\n            ] );\n        }\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        continue<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, $filename );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">is_dir<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> is_writable<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $move_new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $file[<\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $new_file<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">false<\/span><span style=\"color:#F97583\"> !==<\/span><span style=\"color:#E1E4E8\"> $move_new_file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            chmod<\/span><span style=\"color:#E1E4E8\">( $new_file, <\/span><span style=\"color:#79B8FF\">0644<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $record<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_file<\/span><span style=\"color:#E1E4E8\">( $id, $index, [<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'path'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#E1E4E8\"> $new_file,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'url'<\/span><span style=\"color:#F97583\">  =><\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_file_url<\/span><span style=\"color:#E1E4E8\">( $filename ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Metoda p\u0159evezme p\u0159\u00edponu p\u0159\u00edmo z n\u00e1zvu souboru, kter\u00fd poslal klient. PHP soubor s p\u0159\u00edponou <code>.php<\/code> se tak mohl ulo\u017eit do adres\u00e1\u0159e <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>. \u00dato\u010dn\u00edk pak mohl nahran\u00fd soubor vyvolat p\u0159es URL a spustit jeho PHP k\u00f3d na serveru.<\/p>\n\n\n\n<p>Nahr\u00e1n\u00ed libovoln\u00e9ho souboru pat\u0159\u00ed mezi nejz\u00e1va\u017en\u011bj\u0161\u00ed t\u0159\u00eddy chyb ve WordPressu. \u00dato\u010dn\u00edk m\u016f\u017ee PHP soubor pou\u017e\u00edt jako webshell nebo jinou techniku pro p\u0159evzet\u00ed kontroly nad webem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u010casov\u00e1 osa opravy<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>24. \u010dervence 2026 byla zranitelnost nahl\u00e1\u0161ena prost\u0159ednictv\u00edm programu Wordfence.<\/li>\n\n\n<li>27. \u010dervence 2026 byla chyba ov\u011b\u0159ena v\u010detn\u011b proof of conceptu a nahl\u00e1\u0161ena t\u00fdmu Elementor.<\/li>\n\n\n<li>2. srpna 2026 Elementor potvrdil, \u017ee stejnou chybu nahl\u00e1sil tak\u00e9 jin\u00fd v\u00fdzkumn\u00edk, a za\u010dal p\u0159ipravovat opravu.<\/li>\n\n\n<li>19. srpna 2026 vy\u0161el Elementor Pro 4.2.2 s \u00faplnou opravou.<\/li>\n\n<\/ul>\n\n\n\n<p>P\u016fvodn\u011b p\u0159id\u011blen\u00e9 CVE se nepou\u017eilo, proto\u017ee stejn\u00e1 zranitelnost u\u017e m\u011bla identifik\u00e1tor p\u0159id\u011blen\u00fd na z\u00e1klad\u011b hl\u00e1\u0161en\u00ed t\u0159et\u00ed strany. Platn\u00fd identifik\u00e1tor je CVE-2026-32475.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Shrnut\u00ed<\/h2>\n\n\n\n<p>Neodkl\u00e1dej aktualizaci Elementor Pro: verze 4.2.2 opravuje chybu, kter\u00e1 na ve\u0159ejn\u00e9m formul\u00e1\u0159i s nepovinn\u00fdm nahr\u00e1v\u00e1n\u00edm soubor\u016f dovolovala obej\u00edt kontrolu typu i velikosti souboru. Po aktualizaci zkontroluj formul\u00e1\u0159e s nahr\u00e1v\u00e1n\u00edm soubor\u016f a ov\u011b\u0159 jejich b\u011b\u017en\u00e9 odes\u00edl\u00e1n\u00ed.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Reference \/ Zdroje<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Sta\u010d\u00ed ve\u0159ejn\u00fd formul\u00e1\u0159 s nepovinn\u00fdm polem pro soubor a \u00fato\u010dn\u00edk mohl obej\u00edt kontrolu typu i velikosti nahr\u00e1vky. Elementor Pro 4.2.2 kritickou chybu opravuje &#8211; zkontroluj aktualizaci hned.<\/p>\n","protected":false},"author":34,"featured_media":223,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[37,143,28,10,81],"class_list":["post-224","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost","tag-bezpecnost","tag-elementor-pro","tag-php","tag-wordpress","tag-zranitelnost"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts\/224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/users\/34"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/comments?post=224"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/posts\/224\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/media\/223"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/media?parent=224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/categories?post=224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/cs\/wp-json\/wp\/v2\/tags?post=224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}