{"id":271,"date":"2026-08-20T17:39:40","date_gmt":"2026-08-20T15:39:40","guid":{"rendered":"https:\/\/helloblog.io\/ro\/actualizeaza-elementor-pro-4-2-2-vulnerabilitate-critica-upload-fisiere\/"},"modified":"2026-08-20T17:39:40","modified_gmt":"2026-08-20T15:39:40","slug":"actualizeaza-elementor-pro-4-2-2-vulnerabilitate-critica-upload-fisiere","status":"publish","type":"post","link":"https:\/\/helloblog.io\/ro\/actualizeaza-elementor-pro-4-2-2-vulnerabilitate-critica-upload-fisiere\/","title":{"rendered":"Actualizeaz\u0103 Elementor Pro la 4.2.2: vulnerabilitate critic\u0103 de upload de fi\u0219iere"},"content":{"rendered":"\n<p>Elementor Pro are o vulnerabilitate critic\u0103 de \u00eenc\u0103rcare arbitrar\u0103 de fi\u0219iere, identificat\u0103 ca <strong>CVE-2026-32475<\/strong>. Problema afecteaz\u0103 toate versiunile p\u00e2n\u0103 la 4.2.1 inclusiv \u0219i permite unui atacator neautentificat s\u0103 \u00eencarce fi\u0219iere cu extensii alese de el, inclusiv fi\u0219iere PHP executabile. Actualizeaz\u0103 pluginul la versiunea <strong>4.2.2<\/strong> sau la cea mai nou\u0103 versiune disponibil\u0103 c\u00e2t mai repede.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Impact critic<\/h4>\n\n\n<p>Vulnerabilitatea are scorul CVSS 9.8 din 10. Un atacator poate ajunge la execu\u021bie de cod la distan\u021b\u0103 \u0219i poate compromite complet site-ul.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Cine este afectat<\/h2>\n\n\n\n<p>Vulnerabilitatea apare \u00een Elementor Website Builder Pro, un plugin WordPress premium cu aproximativ 6 milioane de instal\u0103ri active. Sunt vulnerabile versiunile Elementor Pro <strong>\u2264 4.2.1<\/strong>; versiunea care remediaz\u0103 complet problema este <strong>4.2.2<\/strong>.<\/p>\n\n\n\n<p>Atacul nu cere cont WordPress \u0219i nici permisiuni administrative. Totu\u0219i, atacatorul are nevoie ca site-ul s\u0103 publice o pagin\u0103 care con\u021bine un widget <strong>Form<\/strong> din Elementor Pro, cu cel pu\u021bin un c\u00e2mp <strong>File Upload<\/strong> care nu este marcat ca obligatoriu.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce permite vulnerabilitatea<\/h2>\n\n\n\n<p>Un upload arbitrar de fi\u0219iere apare c\u00e2nd aplica\u021bia accept\u0103 un fi\u0219ier f\u0103r\u0103 s\u0103 \u00eei verifice corect extensia sau tipul. \u00cen acest caz, atacatorul poate trimite un fi\u0219ier PHP \u0219i \u00eel poate executa ulterior printr-un URL public, ceea ce deschide drumul c\u0103tre un webshell \u0219i alte metode de preluare a serverului.<\/p>\n\n\n\n<p>Problema a fost raportat\u0103 responsabil pe 24 iulie 2026 prin programul de bug bounty al Wordfence. Elementor a primit raportul pe 27 iulie, a confirmat c\u0103 o alt\u0103 parte raportase aceea\u0219i problem\u0103 pe 2 august \u0219i a publicat corec\u021bia complet\u0103 pe 19 august 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">De unde porne\u0219te ocolirea valid\u0103rii<\/h2>\n\n\n\n<p>Formularele Elementor Pro ajung la func\u021bia <code>ajax_send_form()<\/code> din clasa <code>Ajax_Handler<\/code>, accesibil\u0103 \u0219i vizitatorilor neautentifica\u021bi. Pluginul \u00eempacheteaz\u0103 datele trimise, inclusiv fi\u0219ierele, \u00eentr-un obiect <code>Form_Record<\/code>, apoi le trimite prin rutinele de validare \u0219i procesare ale clasei <code>ElementorProModulesFormsFieldsUpload<\/code>.<\/p>\n\n\n\n<p>Pentru un c\u00e2mp de upload, fluxul ajunge \u00een <code>validation()<\/code> \u0219i <code>process_field()<\/code>. \u00cen <code>validation()<\/code>, pluginul verific\u0103 mai \u00eent\u00e2i num\u0103rul maxim de fi\u0219iere configurat pentru c\u00e2mp. Apoi parcurge fi\u0219ierele \u0219i ar trebui s\u0103 verifice erorile de upload, tipul permis prin <code>is_file_type_valid()<\/code> \u0219i dimensiunea permis\u0103 prin <code>is_file_size_valid()<\/code>.<\/p>\n\n\n\n<p>Defectul este \u00een bucla care trateaz\u0103 un slot de upload gol. Dac\u0103 acel c\u00e2mp nu este obligatoriu, iar primul element din array are eroarea PHP <code>UPLOAD_ERR_NO_FILE<\/code>, codul folose\u0219te <code>return<\/code>. Astfel, opre\u0219te validarea \u00eentregului c\u00e2mp \u0219i nu mai verific\u0103 niciun fi\u0219ier care urmeaz\u0103 \u00een acela\u0219i array.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    \/\/ C\u00e2mpul nu este obligatoriu, iar primul slot este gol.\n    if ( ! $field['required'] &amp;&amp; UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        return; \/\/ Opre\u0219te validarea tuturor fi\u0219ierelor r\u0103mase.\n    }\n\n    if ( ! $this-&gt;is_file_type_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, 'This file type is not allowed.' );\n    }\n\n    if ( ! $this-&gt;is_file_size_valid( $field, $file ) ) {\n        $ajax_handler-&gt;add_error( $id, 'This file exceeds the maximum allowed size.' );\n    }\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#6A737D\">    \/\/ C\u00e2mpul nu este obligatoriu, iar primul slot este gol.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#E1E4E8\"> $field[<\/span><span style=\"color:#9ECBFF\">'required'<\/span><span style=\"color:#E1E4E8\">] <\/span><span style=\"color:#F97583\">&#x26;&#x26;<\/span><span style=\"color:#79B8FF\"> UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        return<\/span><span style=\"color:#E1E4E8\">; <\/span><span style=\"color:#6A737D\">\/\/ Opre\u0219te validarea tuturor fi\u0219ierelor r\u0103mase.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_type_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#9ECBFF\">'This file type is not allowed.'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#F97583\">!<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">is_file_size_valid<\/span><span style=\"color:#E1E4E8\">( $field, $file ) ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $ajax_handler<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">add_error<\/span><span style=\"color:#E1E4E8\">( $id, <\/span><span style=\"color:#9ECBFF\">'This file exceeds the maximum allowed size.'<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Comportamentul corect ar fi folosit <code>continue<\/code>, care ignor\u0103 doar intrarea goal\u0103 \u0219i continu\u0103 cu urm\u0103torul fi\u0219ier. Din cauza lui <code>return<\/code>, validarea extensiei \u0219i a dimensiunii nu mai ruleaz\u0103 pentru elementele r\u0103mase.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cum poate fi exploatat\u0103<\/h2>\n\n\n\n<p>Atacatorul trimite c\u00e2mpul de upload ca array cu dou\u0103 elemente. Primul element este gol, deci genereaz\u0103 <code>UPLOAD_ERR_NO_FILE<\/code> \u0219i declan\u0219eaz\u0103 ie\u0219irea prematur\u0103 din <code>validation()<\/code>. Al doilea element con\u021bine payloadul PHP, cu extensia aleas\u0103 de atacator, iar pluginul nu \u00eel mai valideaz\u0103.<\/p>\n\n\n\n<p>Func\u021bia <code>process_field()<\/code> trateaz\u0103 diferit slotul gol: folose\u0219te corect <code>continue<\/code>, \u00eel sare \u0219i proceseaz\u0103 al doilea fi\u0219ier, care nu a trecut prin controalele de tip \u0219i dimensiune. Pluginul preia extensia direct din numele de fi\u0219ier trimis de client, creeaz\u0103 un nume unic \u0219i mut\u0103 fi\u0219ierul pe disc.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>foreach ( $files[ $id ] as $index =&gt; $file ) {\n    if ( UPLOAD_ERR_NO_FILE === $file['error'] ) {\n        continue; \/\/ Sare peste slotul gol.\n    }\n\n    $uploads_dir = $this-&gt;get_ensure_upload_dir();\n    $file_extension = pathinfo( $file['name'], PATHINFO_EXTENSION );\n    $filename = wp_unique_filename( $uploads_dir, uniqid() . '.' . $file_extension );\n    $new_file = trailingslashit( $uploads_dir ) . $filename;\n\n    Plugin::instance()-&gt;php_api-&gt;move_uploaded_file(\n        $file['tmp_name'],\n        $new_file\n    );\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">foreach<\/span><span style=\"color:#E1E4E8\"> ( $files[ $id ] <\/span><span style=\"color:#F97583\">as<\/span><span style=\"color:#E1E4E8\"> $index <\/span><span style=\"color:#F97583\">=><\/span><span style=\"color:#E1E4E8\"> $file ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">    if<\/span><span style=\"color:#E1E4E8\"> ( <\/span><span style=\"color:#79B8FF\">UPLOAD_ERR_NO_FILE<\/span><span style=\"color:#F97583\"> ===<\/span><span style=\"color:#E1E4E8\"> $file[<\/span><span style=\"color:#9ECBFF\">'error'<\/span><span style=\"color:#E1E4E8\">] ) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">        continue<\/span><span style=\"color:#E1E4E8\">; <\/span><span style=\"color:#6A737D\">\/\/ Sare peste slotul gol.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $uploads_dir <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> $this<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">get_ensure_upload_dir<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $file_extension <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> pathinfo<\/span><span style=\"color:#E1E4E8\">( $file[<\/span><span style=\"color:#9ECBFF\">'name'<\/span><span style=\"color:#E1E4E8\">], <\/span><span style=\"color:#79B8FF\">PATHINFO_EXTENSION<\/span><span style=\"color:#E1E4E8\"> );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $filename <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> wp_unique_filename<\/span><span style=\"color:#E1E4E8\">( $uploads_dir, <\/span><span style=\"color:#79B8FF\">uniqid<\/span><span style=\"color:#E1E4E8\">() <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#9ECBFF\"> '.'<\/span><span style=\"color:#F97583\"> .<\/span><span style=\"color:#E1E4E8\"> $file_extension );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    $new_file <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> trailingslashit<\/span><span style=\"color:#E1E4E8\">( $uploads_dir ) <\/span><span style=\"color:#F97583\">.<\/span><span style=\"color:#E1E4E8\"> $filename;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">    Plugin<\/span><span style=\"color:#F97583\">::<\/span><span style=\"color:#B392F0\">instance<\/span><span style=\"color:#E1E4E8\">()<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#E1E4E8\">php_api<\/span><span style=\"color:#F97583\">-><\/span><span style=\"color:#B392F0\">move_uploaded_file<\/span><span style=\"color:#E1E4E8\">(<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $file[<\/span><span style=\"color:#9ECBFF\">'tmp_name'<\/span><span style=\"color:#E1E4E8\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">        $new_file<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    );<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Fi\u0219ierul p\u0103streaz\u0103 extensia extras\u0103 din numele controlat de atacator \u0219i ajunge \u00een directorul <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>. Dac\u0103 atacatorul \u00eencarc\u0103 un fi\u0219ier cu extensia <code>.php<\/code>, poate cere ulterior acel URL pentru a executa payloadul PHP pe server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce trebuie s\u0103 faci acum<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Verific\u0103 versiunea Elementor Pro din WordPress, \u00een pagina <strong>Pluginuri<\/strong>.<\/li>\n\n\n<li>Dac\u0103 rulezi versiunea 4.2.1 sau una mai veche, actualizeaz\u0103 imediat la versiunea 4.2.2 sau la cea mai nou\u0103 versiune disponibil\u0103.<\/li>\n\n\n<li>Verific\u0103 paginile publicate care folosesc widgetul Form \u0219i c\u00e2mpuri File Upload, mai ales c\u00e2mpurile care nu sunt obligatorii.<\/li>\n\n\n<li>Dup\u0103 actualizare, caut\u0103 fi\u0219iere nea\u0219teptate \u00een <code>\/wp-content\/uploads\/elementor\/forms\/<\/code>, \u00een special fi\u0219iere cu extensia <code>.php<\/code>, deoarece un site vulnerabil ar fi putut fi deja vizat.<\/li>\n\n\n<li>Dac\u0103 g\u0103se\u0219ti fi\u0219iere suspecte sau indicii de execu\u021bie neautorizat\u0103, trateaz\u0103 situa\u021bia ca pe un posibil compromis al site-ului \u0219i investigheaz\u0103 serverul, conturile WordPress \u0219i fi\u0219ierele modificate.<\/li>\n\n<\/ol>\n\n\n\n<p>Corec\u021bia este disponibil\u0103 din 19 august 2026. Nu te baza pe faptul c\u0103 formularul pare pu\u021bin folosit sau c\u0103 uploadul este op\u021bional: tocmai un c\u00e2mp File Upload neobligatoriu, expus \u00eentr-o pagin\u0103 public\u0103, \u00eendepline\u0219te condi\u021bia necesar\u0103 pentru atac.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Referin\u021be \/ Surse<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/critical-arbitrary-file-upload-vulnerability-patched-in-elementor-pro-wordpress-plugin\/\" target=\"_blank\" rel=\"noopener noreferrer\">Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>O pagin\u0103 public\u0103 cu un formular Elementor Pro configurat aparent inofensiv poate permite \u00eenc\u0103rcarea unui fi\u0219ier PHP \u0219i preluarea site-ului. Actualizeaz\u0103 imediat pluginul dac\u0103 rulezi versiunea 4.2.1 sau una mai veche.<\/p>\n","protected":false},"author":31,"featured_media":270,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[147,146,11,13,10],"class_list":["post-271","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securitate","tag-cve-2026-32475","tag-elementor-pro","tag-securitate","tag-vulnerabilitate","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts\/271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/comments?post=271"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/posts\/271\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/media\/270"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/media?parent=271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/categories?post=271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/ro\/wp-json\/wp\/v2\/tags?post=271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}