This vulnerability (CVE-2026-13242) in the Drupal Geolocation Field module is caused by improper neutralization of special elements in SQL commands, classified under CWE-89 (SQL Injection). It affects all versions from 0.0.0 through 3.15.0. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. No official patch or remediation level has been published yet, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure or modification of data. The vulnerability does not impact availability. Since the attack vector is network-based and requires no privileges or user interaction, it poses a moderate risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Drupal security advisories and consider applying any recommended temporary mitigations or workarounds provided by the vendor. Avoid exposing the vulnerable module to untrusted users or networks where possible.