Threat actors are actively exploiting a security bug in Elementor Pro, a popular WordPress plugin used by over 11 million websites.