Combined Attack on Elementor Pro and Ultimate Addons for Elementor Puts 1 Million Sites at Risk.

Solution:

If you have pro and site registration enabled, attackers can register and upload malicious files.

If you have site registration disabled, but you have ultimate add ons plugin, they can still register a subscriber through a hole, and upload the files.

If anyone is looking for a free fix, they recommend disabling pro and enabling when an update fix happens. You might lose some pro widgets.

Note, it should also be mentioned that if you have Pro, and you don’t have ultimate add ons, you might be fine by turning off user registration, because a user is required to upload the files.

https://www.wordfence.com/blog/2020/05/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk/