This vulnerability (CVE-2024-49333) involves improper neutralization of special elements used in SQL commands (CWE-89) within the Hero Mega Menu - Responsive WordPress Menu Plugin by NotFound. It affects versions up to 1.16.5 and allows an attacker with low privileges to perform SQL Injection attacks remotely without user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. No vendor patch or official remediation is currently documented.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited disruption of availability (low impact). Integrity impact is not indicated. The vulnerability could compromise the database underlying the plugin, affecting the confidentiality of stored data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality and monitor for unusual database activity. Avoid exposing the affected plugin to untrusted users. Do not assume the vulnerability is mitigated without vendor confirmation.