{"id":291,"date":"2026-08-20T17:39:34","date_gmt":"2026-08-20T15:39:34","guid":{"rendered":"https:\/\/helloblog.io\/fr\/elementor-pro-corrige-faille-critique-upload-fichiers\/"},"modified":"2026-08-20T17:39:34","modified_gmt":"2026-08-20T15:39:34","slug":"elementor-pro-corrige-faille-critique-upload-fichiers","status":"publish","type":"post","link":"https:\/\/helloblog.io\/fr\/elementor-pro-corrige-faille-critique-upload-fichiers\/","title":{"rendered":"Elementor Pro corrige une faille critique d\u2019upload de fichiers"},"content":{"rendered":"\n<p>Une faille critique dans Elementor Pro permet \u00e0 un attaquant non authentifi\u00e9 d\u2019envoyer un fichier arbitraire, y compris un fichier PHP ex\u00e9cutable, sur un site WordPress vuln\u00e9rable. Cette faille, r\u00e9f\u00e9renc\u00e9e <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\">CVE-2026-32475<\/a>, obtient un score CVSS de 9,8 sur 10.<\/p>\n\n\n\n<p>Le probl\u00e8me touche Elementor Pro jusqu\u2019\u00e0 la version 4.2.1 incluse. Installez sans attendre Elementor Pro 4.2.2, la premi\u00e8re version qui corrige compl\u00e8tement la faille, ou toute version ult\u00e9rieure disponible.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Quels sites risquent une compromission<\/h2>\n\n\n\n<p>Un site devient exploitable s\u2019il publie une page qui contient un widget Form d\u2019Elementor Pro avec au moins un champ File Upload facultatif. L\u2019attaquant n\u2019a besoin d\u2019aucun compte WordPress pour atteindre le traitement AJAX du formulaire.<\/p>\n\n\n\n<p>Apr\u00e8s avoir envoy\u00e9 un fichier PHP, l\u2019attaquant peut demander son URL afin d\u2019ex\u00e9cuter du code PHP sur le serveur. Une ex\u00e9cution de code \u00e0 distance peut ensuite mener \u00e0 la compromission compl\u00e8te du site, notamment au moyen d\u2019un webshell.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">L\u2019erreur de validation \u00e0 l\u2019origine de la faille<\/h2>\n\n\n\n<p>Elementor Pro traite les soumissions par la m\u00e9thode <code>ajax_send_form()<\/code> de la classe <code>Ajax_Handler<\/code>, accessible aux visiteurs non authentifi\u00e9s. L\u2019extension encapsule les donn\u00e9es contr\u00f4l\u00e9es par le visiteur, y compris les fichiers envoy\u00e9s, dans un objet <code>Form_Record<\/code>, puis les transmet aux routines de validation et de traitement de <code>ElementorProModulesFormsFieldsUpload<\/code>.<\/p>\n\n\n\n<p>La m\u00e9thode <code>validation()<\/code> parcourt les fichiers du champ d\u2019upload. Pour un champ non obligatoire, elle rencontre une entr\u00e9e vide avec l\u2019erreur PHP <code>UPLOAD_ERR_NO_FILE<\/code> et ex\u00e9cute <code>return<\/code>. Cette instruction arr\u00eate toute la validation du champ au lieu de passer \u00e0 l\u2019entr\u00e9e suivante.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    \/\/ Aucun fichier n\u2019a \u00e9t\u00e9 envoy\u00e9 pour cette entr\u00e9e.\n    if ( ! $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        return;\n    }\n\n    \/\/ Le champ obligatoire ne contient pas de fichier.\n    if ( $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    if ( $file['error'] &gt; UPLOAD_ERR_OK ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file type is not allowed.', 'elementor-pro' ) );\n    }\n\n    if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file exceeds the maximum allowed size.', 'elementor-pro' ) );\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Aucun fichier n\u2019a \u00e9t\u00e9 envoy\u00e9 pour cette entr\u00e9e.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Le champ obligatoire ne contient pas de fichier.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">><\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_OK<\/span><span style=\"color:#E1E4E8\"> ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Le code devait employer <code>continue<\/code> dans la premi\u00e8re condition. <code>continue<\/code> ignore uniquement l\u2019entr\u00e9e vide et laisse la boucle v\u00e9rifier les fichiers suivants. Avec <code>return<\/code>, Elementor Pro n\u2019appelle ni <code>is_file_type_valid()<\/code> pour contr\u00f4ler l\u2019extension et le type de fichier, ni <code>is_file_size_valid()<\/code> pour contr\u00f4ler la taille des entr\u00e9es suivantes du m\u00eame champ.<\/p>\n\n\n\n<p>L\u2019attaque exploite un champ envoy\u00e9 sous forme de tableau contenant deux entr\u00e9es. La premi\u00e8re est vide et d\u00e9clenche <code>UPLOAD_ERR_NO_FILE<\/code>, ce qui interrompt la validation. La seconde contient le fichier \u00e0 envoyer avec une extension choisie par l\u2019attaquant, sans que l\u2019extension, le type ni la taille ne soient contr\u00f4l\u00e9s.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Pourquoi le fichier est tout de m\u00eame enregistr\u00e9<\/h2>\n\n\n\n<p>La m\u00e9thode <code>process_field()<\/code> ne reproduit pas cette erreur. Elle utilise <code>continue<\/code> pour ignorer l\u2019entr\u00e9e vide, puis traite l\u2019entr\u00e9e suivante qui n\u2019a pas \u00e9t\u00e9 valid\u00e9e. Elle extrait l\u2019extension directement du nom de fichier fourni par le client, g\u00e9n\u00e8re un nom unique et d\u00e9place le fichier dans le r\u00e9pertoire d\u2019upload des formulaires.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        continue;\n    }\n\n    $uploads_dir = $this-&gt;get_ensure_upload_dir();\n    $file_extension = pathinfo( $file['name'], PATHINFO_EXTENSION );\n    $filename = uniqid() . '.' . $file_extension;\n    $filename = wp_unique_filename( $uploads_dir, $filename );\n    $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n    if ( is_dir( $uploads_dir ) &amp;&amp; is_writable( $uploads_dir ) ) {\n        $move_new_file = Plugin::instance()-&gt;php_api-&gt;move_uploaded_file(\n            $file['tmp_name'],\n            $new_file\n        );\n\n        if ( false !== $move_new_file ) {\n            chmod( $new_file, 0644 );\n            $record-&gt;add_file( $id, $index, [\n                'path' =&gt; $new_file,\n                'url' =&gt; $this-&gt;get_file_url( $filename ),\n            ] );\n        }\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        continue<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, $filename );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">is_dir<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> is_writable<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $move_new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $file[<\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $new_file<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">false<\/span><span style=\"color:#F97583\"> !==<\/span><span style=\"color:#E1E4E8\"> $move_new_file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            chmod<\/span><span style=\"color:#E1E4E8\">( $new_file, <\/span><span style=\"color:#79B8FF\">0644<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $record<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_file<\/span><span style=\"color:#E1E4E8\">( $id, $index, [<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'path'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#E1E4E8\"> $new_file,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'url'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_file_url<\/span><span style=\"color:#E1E4E8\">( $filename ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>L\u2019extension conserve donc l\u2019extension transmise dans le nom du fichier. Un fichier suffix\u00e9 par <code>.php<\/code> peut \u00eatre \u00e9crit dans <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>, puis \u00eatre appel\u00e9 par HTTP pour lancer sa charge PHP sur le serveur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Mettre Elementor Pro \u00e0 jour<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>V\u00e9rifiez la version d\u2019Elementor Pro install\u00e9e sur chaque site WordPress.<\/li>\n\n\n<li>Consid\u00e9rez toutes les versions jusqu\u2019\u00e0 4.2.1 incluse comme vuln\u00e9rables.<\/li>\n\n\n<li>Mettez l\u2019extension \u00e0 jour vers la version 4.2.2 au minimum.<\/li>\n\n\n<li>Contr\u00f4lez en priorit\u00e9 les pages publi\u00e9es qui utilisent un widget Form avec un champ File Upload non obligatoire.<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-group callout callout-warning is-style-warning is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Correctif n\u00e9cessaire<\/h4>\n\n\n<p>Modifier le caract\u00e8re obligatoire d\u2019un champ d\u2019upload ne remplace pas la mise \u00e0 jour. Le correctif complet se trouve dans Elementor Pro 4.2.2.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Chronologie de la divulgation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>24 juillet 2026\u00a0: Wordfence re\u00e7oit le signalement de cette vuln\u00e9rabilit\u00e9 d\u2019upload de fichiers arbitraires non authentifi\u00e9 dans Elementor Pro.<\/li>\n\n\n<li>27 juillet 2026\u00a0: le signalement et la preuve de concept sont valid\u00e9s, puis la faille est communiqu\u00e9e \u00e0 l\u2019\u00e9diteur.<\/li>\n\n\n<li>2 ao\u00fbt 2026\u00a0: l\u2019\u00e9diteur indique qu\u2019un autre chercheur a \u00e9galement signal\u00e9 la faille et qu\u2019il pr\u00e9pare un correctif.<\/li>\n\n\n<li>19 ao\u00fbt 2026\u00a0: Elementor Pro 4.2.2 para\u00eet avec le correctif complet.<\/li>\n\n<\/ul>\n\n\n\n<p>L\u2019\u00e9diteur a attribu\u00e9 le CVE d\u00e9j\u00e0 associ\u00e9 au signalement tiers, CVE-2026-32475. Si vous g\u00e9rez plusieurs sites, contr\u00f4lez d\u00e8s maintenant les installations Elementor Pro et d\u00e9ployez la version corrig\u00e9e partout o\u00f9 l\u2019extension est pr\u00e9sente.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>R\u00e9f\u00e9rences \/ Sources<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Elementor Pro 4.2.1 et les versions ant\u00e9rieures permettent \u00e0 un visiteur non authentifi\u00e9 d\u2019envoyer un fichier PHP dans certaines configurations de formulaires. Mettez imm\u00e9diatement l\u2019extension \u00e0 jour vers la version 4.2.2 ou une version plus r\u00e9cente.<\/p>\n","protected":false},"author":13,"featured_media":290,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[138,119,24,13,10],"class_list":["post-291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securite","tag-elementor-pro","tag-mise-a-jour","tag-php","tag-vulnerabilite","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts\/291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/comments?post=291"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/posts\/291\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/media\/290"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/media?parent=291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/categories?post=291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/fr\/wp-json\/wp\/v2\/tags?post=291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}