The NotFound Hero Mega Menu - Responsive WordPress Menu Plugin contains an SQL Injection vulnerability (CWE-89) identified as CVE-2024-49303. This flaw arises from improper neutralization of special elements in SQL commands, allowing attackers with low privileges to inject SQL code. The vulnerability affects all versions up to 1.16.5. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality (high) and availability (low). No official patch or remediation level has been published by the vendor. The vulnerability is not related to a cloud service and no known exploits have been reported.

Successful exploitation could allow an attacker with low privileges to perform SQL Injection attacks, potentially leading to unauthorized access to sensitive data (confidentiality impact is high) and limited disruption of service (availability impact is low). Integrity impact is not indicated. The vulnerability is exploitable remotely over the network without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin or restricting access to it to reduce exposure. Monitor official NotFound advisories for updates regarding patches or mitigations.