{"id":279,"date":"2026-08-20T17:39:27","date_gmt":"2026-08-20T15:39:27","guid":{"rendered":"https:\/\/helloblog.io\/nl\/kritieke-uploadkwetsbaarheid-elementor-pro-opgelost\/"},"modified":"2026-08-20T17:39:27","modified_gmt":"2026-08-20T15:39:27","slug":"kritieke-uploadkwetsbaarheid-elementor-pro-opgelost","status":"publish","type":"post","link":"https:\/\/helloblog.io\/nl\/kritieke-uploadkwetsbaarheid-elementor-pro-opgelost\/","title":{"rendered":"Kritieke uploadkwetsbaarheid in Elementor Pro opgelost in versie 4.2.2"},"content":{"rendered":"\n<p>Elementor Pro tot en met versie 4.2.1 bevat een kritieke kwetsbaarheid voor het uploaden van willekeurige bestanden. Een aanvaller zonder account kan daardoor een uitvoerbaar PHP-bestand op een kwetsbare WordPress-site plaatsen en vervolgens code op de server uitvoeren. Update Elementor Pro daarom zo snel mogelijk naar versie 4.2.2 of nieuwer.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Direct bijwerken<\/h4>\n\n\n<p>CVE-2026-32475 heeft een CVSS-score van 9,8 op 10. De kwetsbaarheid treft Elementor Pro 4.2.1 en ouder; Elementor Pro 4.2.2 verhelpt het probleem.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Wanneer een site kwetsbaar is<\/h2>\n\n\n\n<p>De fout zit in de Form-widget van Elementor Pro, die bestandsvelden ondersteunt. Misbruik vereist dat je een gepubliceerde pagina hebt met zo&#8217;n formulier \u00e9n dat minstens \u00e9\u00e9n File Upload-veld niet verplicht is. Een bezoeker hoeft niet ingelogd te zijn om de kwetsbaarheid te misbruiken.<\/p>\n\n\n\n<p>Een aanvaller stuurt een uploadveld als array met twee onderdelen. Het eerste onderdeel bevat geen bestand en veroorzaakt <code>UPLOAD_ERR_NO_FILE<\/code>; het tweede bevat een PHP-payload met een zelfgekozen bestandsextensie. Door een fout in de validatie controleert Elementor Pro dat tweede bestand niet.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>CVE-ID:<\/strong> <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-32475\">CVE-2026-32475<\/a><\/li>\n\n\n<li><strong>Ernst:<\/strong> 9,8\/10 (kritiek)<\/li>\n\n\n<li><strong>Getroffen software:<\/strong> Elementor Website Builder Pro (<code>elementor-pro<\/code>)<\/li>\n\n\n<li><strong>Getroffen versies:<\/strong> 4.2.1 en ouder<\/li>\n\n\n<li><strong>Opgeloste versie:<\/strong> 4.2.2<\/li>\n\n\n<li><strong>Voorwaarde voor misbruik:<\/strong> een gepubliceerd Elementor Pro-formulier met minstens \u00e9\u00e9n niet-verplicht File Upload-veld<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">De fout in de validatielus<\/h2>\n\n\n\n<p>Niet-ingelogde bezoekers bereiken de formulierverwerking via <code>ajax_send_form()<\/code> in de klasse <code>Ajax_Handler<\/code>. Elementor Pro verpakt de ingestuurde gegevens en bestanden daarna in een <code>Form_Record<\/code>-object. Voor bestandsvelden roept de plugin achtereenvolgens <code>validation()<\/code> en <code>process_field()<\/code> aan in <code>ElementorProModulesFormsFieldsUpload<\/code>.<\/p>\n\n\n\n<p>De validatielus hoort een leeg uploadslot over te slaan met <code>continue<\/code>. In de kwetsbare versies gebruikt de code echter <code>return<\/code>. Zodra het eerste arrayelement <code>UPLOAD_ERR_NO_FILE<\/code> bevat en het veld niet verplicht is, stopt de hele functie. Elementor Pro voert daarna geen controle op extensie of bestandstype via <code>is_file_type_valid()<\/code> en ook geen bestandsgroottecontrole meer uit voor de volgende bestanden in hetzelfde veld.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>public function validation( $field , ClassesForm_Record $record , ClassesAjax_Handler $ajax_handler ) {\n    static $upload_errors = false;\n\n    if ( ! $upload_errors ) {\n        $upload_errors = [\n            UPLOAD_ERR_OK =&gt; esc_html__( 'There is no error, the file uploaded with success.' , 'elementor-pro' ),\n            \/* translators: 1: upload_max_filesize, 2: php.ini *\/\n            UPLOAD_ERR_INI_SIZE =&gt; sprintf( esc_html__( 'The uploaded file exceeds the %1$s directive in %2$s.' , 'elementor-pro' ), 'upload_max_filesize' , 'php.ini' ),\n            \/* translators: %s: MAX_FILE_SIZE *\/\n            UPLOAD_ERR_FORM_SIZE =&gt; sprintf( esc_html__( 'The uploaded file exceeds the %s directive that was specified in the HTML form.' , 'elementor-pro' ), 'MAX_FILE_SIZE' ),\n            UPLOAD_ERR_PARTIAL =&gt; esc_html__( 'The uploaded file was only partially uploaded.' , 'elementor-pro' ),\n            UPLOAD_ERR_NO_FILE =&gt; esc_html__( 'No file was uploaded.' , 'elementor-pro' ),\n            UPLOAD_ERR_NO_TMP_DIR =&gt; esc_html__( 'Missing a temporary folder.' , 'elementor-pro' ),\n            UPLOAD_ERR_CANT_WRITE =&gt; esc_html__( 'Failed to write file to disk.' , 'elementor-pro' ),\n            \/* translators: %s: phpinfo() *\/\n            UPLOAD_ERR_EXTENSION =&gt; sprintf( esc_html__( 'A PHP extension stopped the file upload. PHP does not provide a way to ascertain which extension caused the file upload to stop; examining the list of loaded extensions with %s may help.' , 'elementor-pro' ), 'phpinfo()' ),\n        ];\n    }\n\n    $this-&gt;fix_file_indices();\n    $id = $field[ 'id' ];\n    $files = Utils::_unstable_get_super_global_value( $_FILES, 'form_fields' );\n\n    if ( ! empty( $field[ 'max_files' ] ) ) {\n        if ( count( $files[ $id ] ) &gt; $field[ 'max_files' ] ) {\n            $error_message = sprintf(\n                \/* translators: %d: Maximum number of allowed files. *\/\n                _n( 'You can upload only %d file.', 'You can upload up to %d files.', intval( $field[ 'max_files' ] ), 'elementor-pro' ),\n                intval( $field[ 'max_files' ] )\n            );\n            $ajax_handler-&gt;add_error( $id, $error_message );\n            return;\n        }\n    }\n\n    foreach ( $files[ $id ] as $index =&gt; $file ) {\n        \/\/ not uploaded\n        if ( ! $field[ 'required' ] &amp;&amp; UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {\n            return;\n        }\n\n        \/\/ is the file required and missing?\n        if ( $field[ 'required' ] &amp;&amp; UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {\n            $ajax_handler-&gt;add_error( $id, $upload_errors[ $file[ 'error' ] ] );\n            return;\n        }\n\n        \/\/ Has any error with upload the file?\n        if ( $file[ 'error' ] &gt; UPLOAD_ERR_OK ) {\n            $ajax_handler-&gt;add_error( $id, $upload_errors[ $file[ 'error' ] ] );\n            return;\n        }\n\n        \/\/ valid file type?\n        if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n            $ajax_handler-&gt;add_error( $id, esc_html__( 'This file type is not allowed.', 'elementor-pro' ) );\n        }\n\n        \/\/ allowed file size?\n        if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n            $ajax_handler-&gt;add_error( $id, esc_html__( 'This file exceeds the maximum allowed size.', 'elementor-pro' ) );\n        }\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">public<\/span><span style=\"color:#F97583\"> function<\/span><span style=\"color:#B392F0\"> validation<\/span><span style=\"color:#E1E4E8\">( $field , <\/span><span style=\"color:#79B8FF\">ClassesForm_Record<\/span><span style=\"color:#E1E4E8\"> $record , <\/span><span style=\"color:#79B8FF\">ClassesAjax_Handler<\/span><span style=\"color:#E1E4E8\"> $ajax_handler ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    static<\/span><span style=\"color:#E1E4E8\"> $upload_errors <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> false<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $upload_errors ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $upload_errors <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> [<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_OK<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#B392F0\"> esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'There is no error, the file uploaded with success.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">            \/* translators: 1: upload_max_filesize, 2: php.ini *\/<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_INI_SIZE<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> sprintf<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'The uploaded file exceeds the %1$s directive in %2$s.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ), <\/span><span style=\"color:#9ECBFF\">'upload_max_filesize'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'php.ini'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">            \/* translators: %s: MAX_FILE_SIZE *\/<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_FORM_SIZE<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> sprintf<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'The uploaded file exceeds the %s directive that was specified in the HTML form.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ), <\/span><span style=\"color:#9ECBFF\">'MAX_FILE_SIZE'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_PARTIAL<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#B392F0\"> esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'The uploaded file was only partially uploaded.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#B392F0\"> esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'No file was uploaded.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_NO_TMP_DIR<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#B392F0\"> esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'Missing a temporary folder.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_CANT_WRITE<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#B392F0\"> esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'Failed to write file to disk.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">            \/* translators: %s: phpinfo() *\/<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">            UPLOAD_ERR_EXTENSION<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> sprintf<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'A PHP extension stopped the file upload. PHP does not provide a way to ascertain which extension caused the file upload to stop; examining the list of loaded extensions with %s may help.'<\/span><span style=\"color:#E1E4E8\"> , <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ), <\/span><span style=\"color:#9ECBFF\">'phpinfo()'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        ];<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">    $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">fix_file_indices<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $id <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> $field[ <\/span><span style=\"color:#9ECBFF\">'id'<\/span><span style=\"color:#E1E4E8\"> ];<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $files <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Utils<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">_unstable_get_super_global_value<\/span><span style=\"color:#E1E4E8\">( $_FILES, <\/span><span style=\"color:#9ECBFF\">'form_fields'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> empty<\/span><span style=\"color:#E1E4E8\">( $field[ <\/span><span style=\"color:#9ECBFF\">'max_files'<\/span><span style=\"color:#E1E4E8\"> ] ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">count<\/span><span style=\"color:#E1E4E8\">( $files[ $id ] ) <\/span><span style=\"color:#F97583\">><\/span><span style=\"color:#E1E4E8\"> $field[ <\/span><span style=\"color:#9ECBFF\">'max_files'<\/span><span style=\"color:#E1E4E8\"> ] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $error_message <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> sprintf<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">                \/* translators: %d: Maximum number of allowed files. *\/<\/span><\/span>\n<span class=\"line\"><span style=\"color:#B392F0\">                _n<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'You can upload only %d file.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'You can upload up to %d files.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#79B8FF\">intval<\/span><span style=\"color:#E1E4E8\">( $field[ <\/span><span style=\"color:#9ECBFF\">'max_files'<\/span><span style=\"color:#E1E4E8\"> ] ), <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">                intval<\/span><span style=\"color:#E1E4E8\">( $field[ <\/span><span style=\"color:#9ECBFF\">'max_files'<\/span><span style=\"color:#E1E4E8\"> ] )<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $error_message );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">        \/\/ not uploaded<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[ <\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\"> ] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">        \/\/ is the file required and missing?<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( $field[ <\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\"> ] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">        \/\/ Has any error with upload the file?<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] <\/span><span style=\"color:#F97583\">><\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_OK<\/span><span style=\"color:#E1E4E8\"> ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, $upload_errors[ $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            return<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">        \/\/ valid file type?<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">        \/\/ allowed file size?<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Waarom een PHP-bestand toch op de server belandt<\/h2>\n\n\n\n<p>De functie <code>process_field()<\/code> behandelt hetzelfde uploadveld na de voortijdig afgebroken validatie. Deze functie gebruikt bij een leeg eerste onderdeel w\u00e9l <code>continue<\/code>. Daardoor slaat zij het lege element over en verwerkt zij alsnog het tweede, niet-gevalideerde bestand.<\/p>\n\n\n\n<p><code>process_field()<\/code> haalt de extensie rechtstreeks uit de bestandsnaam die de cli\u00ebnt aanlevert. Daarna schrijft de functie het bestand met die extensie naar de schijf. Een bestand met de extensie <code>.php<\/code> komt zo terecht in <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>; een aanvaller kan dat bestand vervolgens opvragen om de PHP-payload op de server uit te voeren. Dit maakt een volledige siteovername mogelijk, onder meer met webshells.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>public function process_field( $field , ClassesForm_Record $record , ClassesAjax_Handler $ajax_handler ) {\n    $id = $field[ 'id' ];\n    $files = Utils::_unstable_get_super_global_value( $_FILES, 'form_fields' );\n\n    foreach ( $files[ $id ] as $index =&gt; $file ) {\n        if ( UPLOAD_ERR_NO_FILE === $file[ 'error' ] ) {\n            continue;\n        }\n\n        $uploads_dir = $this-&gt;get_ensure_upload_dir();\n        $file_extension = pathinfo( $file[ 'name' ], PATHINFO_EXTENSION );\n        $filename = uniqid() . '.' . $file_extension;\n        $filename = wp_unique_filename( $uploads_dir, $filename );\n        $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n        if ( is_dir( $uploads_dir ) &amp;&amp; is_writable( $uploads_dir ) ) {\n            $move_new_file = Plugin::instance()-&gt;php_api-&gt;move_uploaded_file( $file[ 'tmp_name' ], $new_file );\n\n            if ( false !== $move_new_file ) {\n                \/\/ Set correct file permissions.\n                $perms = 0644;\n                @chmod( $new_file, $perms );\n                $record-&gt;add_file( $id, $index, [\n                    'path' =&gt; $new_file,\n                    'url' =&gt; $this-&gt;get_file_url( $filename ),\n                ] );\n            } else {\n                $ajax_handler-&gt;add_error( $id, esc_html__( 'There was an error while trying to upload your file.', 'elementor-pro' ) );\n            }\n        } else {\n            $ajax_handler-&gt;add_admin_error_message( esc_html__( 'Upload directory is not writable or does not exist.', 'elementor-pro' ) );\n        }\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">public<\/span><span style=\"color:#F97583\"> function<\/span><span style=\"color:#B392F0\"> process_field<\/span><span style=\"color:#E1E4E8\">( $field , <\/span><span style=\"color:#79B8FF\">ClassesForm_Record<\/span><span style=\"color:#E1E4E8\"> $record , <\/span><span style=\"color:#79B8FF\">ClassesAjax_Handler<\/span><span style=\"color:#E1E4E8\"> $ajax_handler ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $id <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> $field[ <\/span><span style=\"color:#9ECBFF\">'id'<\/span><span style=\"color:#E1E4E8\"> ];<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $files <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Utils<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">_unstable_get_super_global_value<\/span><span style=\"color:#E1E4E8\">( $_FILES, <\/span><span style=\"color:#9ECBFF\">'form_fields'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[ <\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\"> ] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            continue<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[ <\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\"> ], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, $filename );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">is_dir<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> is_writable<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $move_new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">( $file[ <\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\"> ], $new_file );<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">            if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">false<\/span><span style=\"color:#F97583\"> !==<\/span><span style=\"color:#E1E4E8\"> $move_new_file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">                \/\/ Set correct file permissions.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">                $perms <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0644<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">                @<\/span><span style=\"color:#79B8FF\">chmod<\/span><span style=\"color:#E1E4E8\">( $new_file, $perms );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">                $record<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_file<\/span><span style=\"color:#E1E4E8\">( $id, $index, [<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                    'path'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#E1E4E8\"> $new_file,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#9ECBFF\">                    'url'<\/span><span style=\"color:#F97583\"> =><\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_file_url<\/span><span style=\"color:#E1E4E8\">( $filename ),<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">                ] );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            } <\/span><span style=\"color:#F97583\">else<\/span><span style=\"color:#E1E4E8\"> {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">                $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'There was an error while trying to upload your file.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        } <\/span><span style=\"color:#F97583\">else<\/span><span style=\"color:#E1E4E8\"> {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">            $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_admin_error_message<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#B392F0\">esc_html__<\/span><span style=\"color:#E1E4E8\">( <\/span><span style=\"color:#9ECBFF\">'Upload directory is not writable or does not exist.'<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">'elementor-pro'<\/span><span style=\"color:#E1E4E8\"> ) );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Patch en tijdlijn<\/h2>\n\n\n\n<p>Een beveiligingsonderzoeker meldde de kwetsbaarheid op 24 juli 2026 via het bugbountyprogramma van Wordfence. Na validatie van het proof of concept volgde de melding aan Elementor op 27 juli. Op 2 augustus liet Elementor weten dat een andere onderzoeker dezelfde kwetsbaarheid ook had gemeld en dat het team aan een patch werkte.<\/p>\n\n\n\n<p>Elementor bracht op 19 augustus 2026 versie 4.2.2 uit, die de fout volledig oplost. Voor deze kwetsbaarheid geldt de CVE die al aan de andere melding was toegewezen: CVE-2026-32475.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Controleer je Elementor Pro-versie<\/h2>\n\n\n\n<p>Open het WordPress-dashboard en controleer welke versie van Elementor Pro actief is. Draait je site versie 4.2.1 of ouder, installeer dan onmiddellijk versie 4.2.2 of een latere versie. Controleer ook alle beheerde sites met Elementor Pro, vooral sites waarop openbare formulieren bestandsuploads accepteren.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Referenties \/ Bronnen<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Gebruik je Elementor Pro-formulieren met een optioneel bestandsveld? Werk direct bij naar versie 4.2.2: een aanvaller zonder account kon anders uitvoerbare PHP-bestanden uploaden en je site overnemen.<\/p>\n","protected":false},"author":21,"featured_media":278,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[144,145,142,143,10],"class_list":["post-279","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-beveiliging","tag-beveiligingsupdate","tag-cve-2026-32475","tag-elementor-pro","tag-kwetsbaarheid","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/posts\/279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/comments?post=279"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/posts\/279\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/media\/278"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/media?parent=279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/categories?post=279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/nl\/wp-json\/wp\/v2\/tags?post=279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}