{"id":239,"date":"2026-08-20T17:39:38","date_gmt":"2026-08-20T15:39:38","guid":{"rendered":"https:\/\/helloblog.io\/sk\/elementor-pro-opravil-kriticku-chybu-nahravania-suborov\/"},"modified":"2026-08-20T17:39:38","modified_gmt":"2026-08-20T15:39:38","slug":"elementor-pro-opravil-kriticku-chybu-nahravania-suborov","status":"publish","type":"post","link":"https:\/\/helloblog.io\/sk\/elementor-pro-opravil-kriticku-chybu-nahravania-suborov\/","title":{"rendered":"Elementor Pro opravil kritick\u00fa chybu nahr\u00e1vania s\u00faborov"},"content":{"rendered":"\n

V plugine Elementor Pro<\/a> sa na\u0161la kritick\u00e1 zranite\u013enos\u0165, ktor\u00e1 \u00fato\u010dn\u00edkovi bez \u00fa\u010dtu umo\u017e\u0148uje nahra\u0165 \u013eubovo\u013en\u00fd s\u00fabor vr\u00e1tane spustite\u013en\u00e9ho PHP. Chyba zasahuje v\u0161etky verzie po 4.2.1 vr\u00e1tane a m\u00f4\u017ee vies\u0165 k vzdialen\u00e9mu spusteniu k\u00f3du aj \u00fapln\u00e9mu ovl\u00e1dnutiu webovej str\u00e1nky.<\/p>\n\n\n\n

\n\n

Aktualizuj Elementor Pro<\/h4>\n\n\n

Nain\u0161taluj Elementor Pro 4.2.2 alebo nov\u0161iu verziu \u010do najsk\u00f4r. Zranite\u013enos\u0165 m\u00e1 sk\u00f3re CVSS 9,8 z 10 a eviduje sa ako CVE-2026-32475<\/a>.<\/p>\n\n<\/div>\n\n\n\n

Kedy je web zranite\u013en\u00fd<\/h2>\n\n\n\n

Chyba sa prejav\u00ed len pri konkr\u00e9tnej konfigur\u00e1cii. Web mus\u00ed ma\u0165 publikovan\u00fa str\u00e1nku s Form widgetom z Elementor Pro a aspo\u0148 jedno pole File Upload, ktor\u00e9 nem\u00e1\u0161 ozna\u010den\u00e9 ako povinn\u00e9. Elementor Pro m\u00e1 odhadom 6 000 000 akt\u00edvnych in\u0161tal\u00e1ci\u00ed, preto sa oplat\u00ed skontrolova\u0165 v\u0161etky webov\u00e9 str\u00e1nky, ktor\u00e9 spravuje\u0161.<\/p>\n\n\n\n

    \n\n
  1. V n\u00e1stenke WordPressu otvor zoznam pluginov a over verziu Elementor Pro.<\/li>\n\n\n
  2. Ak pou\u017e\u00edva\u0161 verziu 4.2.1 alebo star\u0161iu, aktualizuj plugin na 4.2.2 alebo nov\u0161\u00ed dostupn\u00fd release.<\/li>\n\n\n
  3. Prejdi publikovan\u00e9 formul\u00e1re Elementor Pro a identifikuj polia File Upload, ktor\u00e9 nie s\u00fa povinn\u00e9.<\/li>\n\n\n
  4. K\u00fdm aktualiz\u00e1ciu nenasad\u00ed\u0161, obmedz pr\u00edstup k dotknut\u00fdm formul\u00e1rom alebo ich do\u010dasne zru\u0161 z publikovan\u00fdch str\u00e1nok.<\/li>\n\n<\/ol>\n\n\n\n

    Chyba preru\u0161ila valid\u00e1ciu po prvom pr\u00e1zdnom s\u00fabore<\/h2>\n\n\n\n

    Formul\u00e1r sprac\u00fava odoslanie cez met\u00f3du ajax_send_form()<\/code> v triede Ajax_Handler<\/code>, ktor\u00fa m\u00f4\u017ee zavola\u0165 aj n\u00e1v\u0161tevn\u00edk bez prihl\u00e1senia. Plugin vlo\u017e\u00ed d\u00e1ta formul\u00e1ra a nahran\u00e9 s\u00fabory do objektu Form_Record<\/code>, potom ich pri poli File Upload odovzd\u00e1 met\u00f3dam validation()<\/code> a process_field()<\/code> v triede ElementorProModulesFormsFieldsUpload<\/code>.<\/p>\n\n\n\n

    Met\u00f3da validation()<\/code> najprv uprav\u00ed indexy s\u00faborov, na\u010d\u00edta $_FILES['form_fields']<\/code> a pri nastavenom limite kontroluje maxim\u00e1lny po\u010det s\u00faborov. Vo valida\u010dnom cykle v\u0161ak pri nepovinnom poli ukon\u010dila cel\u00fa met\u00f3du pr\u00edkazom return<\/code>, ak prv\u00e1 polo\u017eka po\u013ea obsahovala chybu UPLOAD_ERR_NO_FILE<\/code>. Namiesto toho mala pou\u017ei\u0165 continue<\/code>, ktor\u00fd by presko\u010dil iba pr\u00e1zdnu polo\u017eku a pokra\u010doval kontrolou \u010fal\u0161ej.<\/p>\n\n\n\n

    <\/circle><\/circle><\/circle><\/g><\/svg><\/span>