Hackers are actively exploiting two security vulnerabilities in the Elementor Pro and Ultimate Addons for Elementor WordPress plugins with the end goal of remotely executing arbitrary code and fully compromising unpatched targets. One vulnerability is a remote code execution bug rated as Critical that allows attackers with registered user access to upload arbitrary files on the targeted websites and execute code remotely. Another vulnerability affecting the Ultimate. plugin (installed on over 110,000 sites) will allow them to register as subscriber-level users on any site running the plugin even if user registration is disabled.
Source: https://www.bleepingcomputer.com/news/security/critical-wordpress-plugin-bug-lets-hackers-take-over-1m-sites/