{"id":264,"date":"2026-08-20T17:39:10","date_gmt":"2026-08-20T15:39:10","guid":{"rendered":"https:\/\/helloblog.io\/lv\/elementor-pro-kritiska-failu-augsupielades-ievainojamiba\/"},"modified":"2026-08-20T17:39:10","modified_gmt":"2026-08-20T15:39:10","slug":"elementor-pro-kritiska-failu-augsupielades-ievainojamiba","status":"publish","type":"post","link":"https:\/\/helloblog.io\/lv\/elementor-pro-kritiska-failu-augsupielades-ievainojamiba\/","title":{"rendered":"Elementor Pro nov\u0113r\u0161 kritisku failu aug\u0161upiel\u0101des ievainojam\u012bbu"},"content":{"rendered":"\n<p>Elementor Pro ir nov\u0113rsis kritisku ievainojam\u012bbu <strong>CVE-2026-32475<\/strong>, kas skar visas spraud\u0146a versijas l\u012bdz 4.2.1 ieskaitot. T\u0101 \u013cauj neautentific\u0113tam uzbruc\u0113jam aug\u0161upiel\u0101d\u0113t patva\u013c\u012bgu failu, ar\u012b izpild\u0101mu PHP failu, un rezult\u0101t\u0101 att\u0101lin\u0101ti palaist kodu server\u012b vai p\u0101r\u0146emt visu vietni.<\/p>\n\n\n\n<p>Risks attiecas uz public\u0113t\u0101m lap\u0101m, kur\u0101s ir Elementor Pro Form logr\u012bks ar vismaz vienu File Upload lauku, kas nav atz\u012bm\u0113ts k\u0101 oblig\u0101ts. Elementor Pro ir aptuveni 6 miljoni akt\u012bvu instal\u0101ciju, t\u0101p\u0113c p\u0101rbaudi atjaunin\u0101jumu nekav\u0113joties.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Nepiecie\u0161ama t\u016bl\u012bt\u0113ja r\u012bc\u012bba<\/h4>\n\n\n<p>Atjaunini Elementor Pro uz versiju 4.2.2 vai jaun\u0101ku. Versija 4.2.2 piln\u012bb\u0101 nov\u0113r\u0161 CVE-2026-32475.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Ko ievainojam\u012bba \u013cauj izdar\u012bt<\/h2>\n\n\n\n<p>Ievainojam\u012bba sa\u0146\u0113musi CVSS nov\u0113rt\u0113jumu <strong>9,8 no 10<\/strong> jeb kritisku pak\u0101pi. T\u0101 ir neierobe\u017eota failu tipu aug\u0161upiel\u0101de: uzbruc\u0113jam nav vajadz\u012bgs WordPress lietot\u0101ja konts, ja vien vi\u0146\u0161 atrod ievainojamajam nosac\u012bjumam atbilsto\u0161u publisku formu.<\/p>\n\n\n\n<p>Uzbrukumam vajag File Upload lauku, kas nav oblig\u0101ts. Uzbruc\u0113js iesniedz lauku k\u0101 mas\u012bvu ar diviem elementiem: pirmais ir tuk\u0161s, bet otraj\u0101 atrodas fails ar pa\u0161a izv\u0113l\u0113tu papla\u0161in\u0101jumu. \u0160is pa\u0146\u0113miens apiet faila papla\u0161in\u0101juma un izm\u0113ra p\u0101rbaudi.<\/p>\n\n\n\n<p>Ja serveris p\u0113c aug\u0161upiel\u0101des izpilda PHP failus aug\u0161upiel\u0101\u017eu direktorij\u0101, uzbruc\u0113js var piepras\u012bt aug\u0161upiel\u0101d\u0113to failu un palaist taj\u0101 ievietoto PHP kodu. \u0160\u0101das patva\u013c\u012bgas failu aug\u0161upiel\u0101des ievainojam\u012bbas bie\u017ei \u013cauj izvietot webshell un piln\u012bb\u0101 kompromit\u0113t vietni.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">K\u013c\u016bda valid\u0101cijas cikl\u0101<\/h2>\n\n\n\n<p>Elementor Pro Form logr\u012bks apstr\u0101d\u0101 formu iesniegumus ar <code>Ajax_Handler<\/code> klases funkciju <code>ajax_send_form()<\/code>, kuru var sasniegt ar\u012b neautentific\u0113ts apmekl\u0113t\u0101js. Spraudnis iesniegtos laukus un failus ievieto <code>Form_Record<\/code> objekt\u0101, p\u0113c tam File Upload laukus nodod <code>ElementorProModulesFormsFieldsUpload<\/code> klases funkcij\u0101m <code>validation()<\/code> un <code>process_field()<\/code>.<\/p>\n\n\n\n<p>Probl\u0113ma bija <code>validation()<\/code> cikl\u0101. Ja neoblig\u0101t\u0101 lauk\u0101 pirmais mas\u012bva elements nebija aug\u0161upiel\u0101d\u0113ts un tam bija PHP k\u013c\u016bdas kods <code>UPLOAD_ERR_NO_FILE<\/code>, kods izsauca <code>return<\/code>, nevis p\u0101rg\u0101ja pie n\u0101kam\u0101 elementa ar <code>continue<\/code>.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    \/\/ Neoblig\u0101tam laukam pirmais tuk\u0161ais elements p\u0101rtrauc visu valid\u0101ciju.\n    if ( ! $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        return;\n    }\n\n    if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, 'This file type is not allowed.' );\n    }\n\n    if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, 'This file exceeds the maximum allowed size.' );\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ Neoblig\u0101tam laukam pirmais tuk\u0161ais elements p\u0101rtrauc visu valid\u0101ciju.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p><code>return<\/code> p\u0101rtrauca visas funkcijas darbu, t\u0101d\u0113\u013c spraudnis vairs nep\u0101rbaud\u012bja p\u0101r\u0113jos t\u0101 pa\u0161a lauka failus. Pareizai r\u012bc\u012bbai vajadz\u0113ja izmantot <code>continue<\/code>: tas izlaistu tikai tuk\u0161o ierakstu un turpin\u0101tu valid\u0113t n\u0101kamo failu.<\/p>\n\n\n\n<p>T\u0101d\u0113j\u0101di otrajam mas\u012bva elementam nepiem\u0113roja <code>is_file_type_valid()<\/code> faila tipa p\u0101rbaudi un faila izm\u0113ra p\u0101rbaudi. Uzbruc\u0113js var\u0113ja ievietot otraj\u0101 element\u0101 PHP failu ar izv\u0113l\u0113tu papla\u0161in\u0101jumu, kam valid\u0101cija visp\u0101r netika izpild\u012bta.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">K\u0101p\u0113c fails tom\u0113r non\u0101k server\u012b<\/h2>\n\n\n\n<p>Lai gan <code>validation()<\/code> darbu p\u0101rtrauca p\u0101r\u0101k agri, <code>process_field()<\/code> tuk\u0161o pirmo elementu apstr\u0101d\u0101ja korekti: t\u0101 izmantoja <code>continue<\/code> un turpin\u0101ja ar n\u0101kamo failu. T\u0101p\u0113c spraudnis apstr\u0101d\u0101ja otro, jau nevalid\u0113to elementu.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        continue;\n    }\n\n    $uploads_dir = $this-&gt;get_ensure_upload_dir();\n    $file_extension = pathinfo( $file['name'], PATHINFO_EXTENSION );\n    $filename = uniqid() . '.' . $file_extension;\n    $filename = wp_unique_filename( $uploads_dir, $filename );\n    $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n    Plugin::instance()-&gt;php_api-&gt;move_uploaded_file(\n        $file['tmp_name'],\n        $new_file\n    );\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        continue<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, $filename );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">    Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $file[<\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $new_file<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Funkcija pa\u0146\u0113ma papla\u0161in\u0101jumu tie\u0161i no klienta iesniegt\u0101 faila nosaukuma, izveidoja unik\u0101lu faila nosaukumu un saglab\u0101ja failu disk\u0101. L\u012bdz ar to fails ar <code>.php<\/code> papla\u0161in\u0101jumu var\u0113ja non\u0101kt direktorij\u0101 <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>, no kurienes uzbruc\u0113js to var\u0113ja piepras\u012bt un izpild\u012bt server\u012b.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kuras versijas skar probl\u0113ma<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Ievainojam\u0101 programmat\u016bra: Elementor Website Builder Pro (<code>elementor-pro<\/code>).<\/li>\n\n\n<li>Ievainojam\u0101s versijas: 4.2.1 un visas vec\u0101kas versijas.<\/li>\n\n\n<li>Labot\u0101 versija: 4.2.2.<\/li>\n\n\n<li>CVE identifikators: <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\">CVE-2026-32475<\/a>.<\/li>\n\n\n<li>CVSS v\u0113rt\u0113jums: 9,8 &#8211; kritisks.<\/li>\n\n\n<li>Atl\u012bdz\u012bba par ievainojam\u012bbas atkl\u0101\u0161anu bija 15 600 ASV dol\u0101ru.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Notikumu laika l\u012bnija<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>2026. gada 24. j\u016blij\u0101 tika sa\u0146emts zi\u0146ojums par neautentific\u0113tu patva\u013c\u012bgu failu aug\u0161upiel\u0101di Elementor Pro.<\/li>\n\n\n<li>2026. gada 27. j\u016blij\u0101 p\u0113tnieki apstiprin\u0101ja zi\u0146ojumu un proof-of-concept uzbrukumu, p\u0113c tam par probl\u0113mu inform\u0113ja Elementor izstr\u0101d\u0101t\u0101jus.<\/li>\n\n\n<li>2026. gada 2. august\u0101 Elementor pazi\u0146oja, ka par \u0161o ievainojam\u012bbu zi\u0146ojis ar\u012b cits p\u0113tnieks un tiek gatavots labojums.<\/li>\n\n\n<li>2026. gada 19. august\u0101 izlaida Elementor Pro 4.2.2 ar pilnu labojumu.<\/li>\n\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Ko p\u0101rbaud\u012bt tagad<\/h2>\n\n\n\n<p>Vispirms p\u0101rbaudi Elementor Pro versiju katr\u0101 WordPress vietn\u0113 un atjaunini to l\u012bdz 4.2.2 vai jaun\u0101kai versijai. \u012apa\u0161i steidzami r\u012bkojies, ja publisk\u0101s lap\u0101s izmanto Form logr\u012bka neoblig\u0101tos File Upload laukus.<\/p>\n\n\n\n<p>P\u0113c atjaunin\u0101\u0161anas p\u0101rskati \u0161\u0101du formu konfigur\u0101ciju un p\u0101rbaudi direktoriju <code>\/wp-content\/uploads\/elementor\/forms\/<\/code> attiec\u012bb\u0101 uz negaid\u012btiem failiem, sevi\u0161\u0137i ar <code>.php<\/code> papla\u0161in\u0101jumu. Ja atrodi aizdom\u012bgus failus vai paz\u012bmes, ka tie tiku\u0161i piepras\u012bti, uzskati vietni par iesp\u0113jami kompromit\u0113tu un s\u0101c incidenta nov\u0113r\u0161anu.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Atsauces \/ Avoti<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><li><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2026-32475<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/0a32b02f-db40-42fe-b46c-4a5f2bc9ba09\" target=\"_blank\" rel=\"noopener noreferrer\">Elementor Pro &lt;= 4.2.1 &#8211; Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Elementor Pro versij\u0101s l\u012bdz 4.2.1 neautentific\u0113ts uzbruc\u0113js var\u0113ja aug\u0161upiel\u0101d\u0113t izpild\u0101mu PHP failu. Ja vietn\u0113 izmanto Form logr\u012bku ar neoblig\u0101tu File Upload lauku, atjaunini spraudni uz 4.2.2 vai jaun\u0101ku versiju.<\/p>\n","protected":false},"author":51,"featured_media":263,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[147,149,148,29,10],"class_list":["post-264","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-drosiba","tag-elementor-pro","tag-failu-augsupielade","tag-ievainojamiba","tag-php","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts\/264","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/comments?post=264"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/posts\/264\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/media\/263"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/media?parent=264"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/categories?post=264"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/lv\/wp-json\/wp\/v2\/tags?post=264"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}