With an estimated install base of over 1 million websites, Elementor Pro is the paid version of the free Elementor plugin (which has more than 4 million users), a drag and drop page builder. Only Elementor Pro, which is available as a separate download, is impacted by the vulnerability.
Assessed with a CVSS score of 9.9, the vulnerability can be exploited by authenticated attackers to upload arbitrary files and execute code remotely on the affected websites.
