CVE-2024-13778 is an SQL Injection vulnerability in the Hero Mega Menu - Responsive WordPress Menu Plugin affecting all versions up to 1.16.5. The issue is due to improper neutralization of special elements in SQL commands, specifically insufficient escaping of user input and lack of prepared statements. This allows authenticated attackers with Subscriber-level privileges or higher to inject additional SQL queries into existing database queries, enabling unauthorized extraction of sensitive information. The vulnerability is rated medium severity with a CVSS score of 6.5. No patch or official fix has been documented, and no known active exploitation has been reported.

An attacker with at least Subscriber-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect availability or integrity but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and privileges to minimize exposure. Monitor for updates from the vendor or security advisories regarding patches or mitigations specific to this vulnerability.