{"id":270,"date":"2026-08-20T17:39:17","date_gmt":"2026-08-20T15:39:17","guid":{"rendered":"https:\/\/helloblog.io\/it\/vulnerabilita-critica-elementor-pro-aggiorna-4-2-2\/"},"modified":"2026-08-20T17:39:17","modified_gmt":"2026-08-20T15:39:17","slug":"vulnerabilita-critica-elementor-pro-aggiorna-4-2-2","status":"publish","type":"post","link":"https:\/\/helloblog.io\/it\/vulnerabilita-critica-elementor-pro-aggiorna-4-2-2\/","title":{"rendered":"Vulnerabilit\u00e0 critica in Elementor Pro: aggiorna alla versione 4.2.2"},"content":{"rendered":"\n<p>Elementor Pro fino alla versione 4.2.1 contiene una vulnerabilit\u00e0 critica di caricamento arbitrario di file senza autenticazione, identificata come <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\">CVE-2026-32475<\/a>. Il problema pu\u00f2 consentire a un attaccante di caricare file eseguibili PHP e arrivare all&#8217;esecuzione di codice remoto, fino al controllo completo del sito.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Aggiorna subito Elementor Pro<\/h4>\n\n\n<p>La correzione \u00e8 disponibile in Elementor Pro 4.2.2, rilasciato il 19 agosto 2026. Tutte le versioni fino alla 4.2.1 inclusa sono vulnerabili.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Quali siti sono esposti<\/h2>\n\n\n\n<p>La vulnerabilit\u00e0 riguarda il plugin premium <a href=\"https:\/\/elementor.com\/pro\/\">Elementor Pro<\/a>, installato su una stima di 6 milioni di siti attivi. Per sfruttarla, un sito deve avere una pagina pubblicata con un widget Form di Elementor Pro che contiene almeno un campo File Upload non obbligatorio.<\/p>\n\n\n\n<p>Un visitatore non deve autenticarsi per raggiungere il percorso vulnerabile. Il punto di ingresso \u00e8 la funzione <code>ajax_send_form()<\/code> della classe <code>Ajax_Handler<\/code>, che riceve le richieste inviate dal modulo e le passa, insieme ai file caricati, a un oggetto <code>Form_Record<\/code> e alle routine di validazione ed elaborazione.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Software interessato: Elementor Website Builder Pro (<code>elementor-pro<\/code>).<\/li>\n\n\n<li>Versioni interessate: tutte fino alla 4.2.1 inclusa.<\/li>\n\n\n<li>Versione corretta: 4.2.2.<\/li>\n\n\n<li>Gravit\u00e0 CVSS: 9,8 su 10, critica.<\/li>\n\n\n<li>Condizione necessaria: una pagina pubblicata con un Form di Elementor Pro e almeno un campo File Upload non obbligatorio.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Come il controllo dei file viene aggirato<\/h2>\n\n\n\n<p>Per i campi File Upload, Elementor Pro usa i metodi <code>validation()<\/code> e <code>process_field()<\/code> della classe <code>ElementorProModulesFormsFieldsUpload<\/code>. Il difetto si trova nel ciclo di validazione: quando il primo elemento dell&#8217;array di file restituisce l&#8217;errore PHP <code>UPLOAD_ERR_NO_FILE<\/code> e il campo non \u00e8 obbligatorio, il metodo esegue <code>return<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    \/\/ Nessun file nel primo slot di un campo facoltativo.\n    if ( ! $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        return;\n    }\n\n    if ( $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    if ( $file['error'] &gt; UPLOAD_ERR_OK ) {\n        $ajax_handler-&gt;add_error( $id, $upload_errors[ $file['error'] ] );\n        return;\n    }\n\n    if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file type is not allowed.', 'elementor-pro' ) );\n    }\n\n    if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, esc_html__( 'This file exceeds the maximum allowed size.', 'elementor-pro' ) );\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Nessun file nel primo slot di un campo facoltativo.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">><\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_OK<\/span><span style=\"color:#E1E4E8\"> ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>In quel punto dovrebbe comparire <code>continue<\/code>: l&#8217;istruzione salterebbe soltanto lo slot vuoto e continuerebbe a controllare gli elementi successivi. <code>return<\/code>, invece, interrompe l&#8217;intero metodo <code>validation()<\/code>. Di conseguenza, Elementor Pro non esegue pi\u00f9 n\u00e9 <code>is_file_type_valid()<\/code> per verificare l&#8217;estensione e il tipo di file, n\u00e9 <code>is_file_size_valid()<\/code> per controllarne la dimensione.<\/p>\n\n\n\n<p>L&#8217;attaccante pu\u00f2 inviare il campo di caricamento come un array con due parti: la prima vuota, che attiva <code>UPLOAD_ERR_NO_FILE<\/code>, e la seconda contenente un file PHP con un&#8217;estensione scelta dall&#8217;attaccante. Il primo elemento arresta la validazione e il secondo non passa dai controlli sull&#8217;estensione, sul tipo e sulla dimensione.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Perch\u00e9 il file arriva comunque sul server<\/h2>\n\n\n\n<p>L&#8217;elaborazione successiva non replica l&#8217;errore. <code>process_field()<\/code> usa <code>continue<\/code> quando incontra uno slot senza file: ignora l&#8217;elemento vuoto, prosegue con il secondo file non validato e lo salva sul disco.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        continue;\n    }\n\n    $uploads_dir = $this-&gt;get_ensure_upload_dir();\n    $file_extension = pathinfo( $file['name'], PATHINFO_EXTENSION );\n    $filename = uniqid() . '.' . $file_extension;\n    $filename = wp_unique_filename( $uploads_dir, $filename );\n    $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n    if ( is_dir( $uploads_dir ) &amp;&amp; is_writable( $uploads_dir ) ) {\n        $move_new_file = Plugin::instance()-&gt;php_api-&gt;move_uploaded_file(\n            $file['tmp_name'],\n            $new_file\n        );\n\n        if ( false !== $move_new_file ) {\n            chmod( $new_file, 0644 );\n            $record-&gt;add_file( $id, $index, [\n                'path' =&gt; $new_file,\n                'url' =&gt; $this-&gt;get_file_url( $filename ),\n            ] );\n        }\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        continue<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, $filename );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">is_dir<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> is_writable<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $move_new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $file[<\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $new_file<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">false<\/span><span style=\"color:#F97583\"> !==<\/span><span style=\"color:#E1E4E8\"> $move_new_file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            chmod<\/span><span style=\"color:#E1E4E8\">( $new_file, <\/span><span style=\"color:#79B8FF\">0644<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $record<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_file<\/span><span style=\"color:#E1E4E8\">( $id, $index, [<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'path'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#E1E4E8\"> $new_file,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                'url'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_file_url<\/span><span style=\"color:#E1E4E8\">( $filename ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Il metodo ricava l&#8217;estensione direttamente dal nome file fornito dal client, genera un nome univoco con <code>uniqid()<\/code>, applica <code>wp_unique_filename()<\/code> e sposta il file nella directory di upload. Un file con estensione <code>.php<\/code> finisce quindi in <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>; richiedendo quel file, un attaccante pu\u00f2 eseguire il payload PHP sul server.<\/p>\n\n\n\n<p>Le vulnerabilit\u00e0 di caricamento arbitrario di file possono portare alla compromissione completa di un sito, anche tramite webshell e altre tecniche. In questo caso la combinazione fra validazione interrotta e successiva elaborazione del file rende possibile la catena di attacco.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cronologia della correzione<\/h2>\n\n\n\n<p>Wordfence ha ricevuto la segnalazione della vulnerabilit\u00e0 il 24 luglio 2026. Il 27 luglio ha validato la segnalazione, confermato il proof of concept e comunicato il problema al team di Elementor.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>24 luglio 2026: viene inviata la segnalazione della vulnerabilit\u00e0 di caricamento arbitrario di file senza autenticazione.<\/li>\n\n\n<li>27 luglio 2026: viene confermato il proof of concept e il problema viene comunicato al fornitore.<\/li>\n\n\n<li>2 agosto 2026: Elementor comunica che un&#8217;altra terza parte ha segnalato la stessa vulnerabilit\u00e0 e che sta preparando una correzione.<\/li>\n\n\n<li>19 agosto 2026: Elementor Pro 4.2.2, con la correzione completa, viene pubblicato.<\/li>\n\n<\/ol>\n\n\n\n<p>Poich\u00e9 la stessa vulnerabilit\u00e0 era stata segnalata anche da un&#8217;altra terza parte, il CVE inizialmente assegnato \u00e8 stato ritirato ed \u00e8 stato adottato l&#8217;identificativo CVE-2026-32475.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cosa fare adesso<\/h2>\n\n\n\n<p>Apri la Bacheca di WordPress, aggiorna Elementor Pro alla versione 4.2.2 o a una versione successiva e verifica che l&#8217;aggiornamento sia stato applicato. Dai priorit\u00e0 ai siti che espongono pagine pubbliche con il widget Form e campi File Upload facoltativi: sono quelli che soddisfano il prerequisito necessario allo sfruttamento della falla.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Riferimenti \/ Fonti<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Una falla critica in Elementor Pro permette il caricamento di file PHP da parte di visitatori non autenticati. Se usi il widget Form con un campo File Upload facoltativo, aggiorna subito il plugin.<\/p>\n","protected":false},"author":18,"featured_media":269,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[142,141,11,13,10],"class_list":["post-270","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sicurezza","tag-cve-2026-32475","tag-elementor-pro","tag-sicurezza","tag-vulnerabilita","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/posts\/270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/comments?post=270"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/posts\/270\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/media\/269"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/media?parent=270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/categories?post=270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/it\/wp-json\/wp\/v2\/tags?post=270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}