This vulnerability (CVE-2026-15081) in the Drupal Location Selector module is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). It affects all versions from 0.0.0 through 1.3.0. The issue allows attackers to inject malicious SQL commands due to insufficient input sanitization. The CVSS v3.1 base score is 7.4, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the affected Drupal Location Selector database. This may lead to unauthorized disclosure or modification of sensitive data. The vulnerability does not impact availability but has high confidentiality and integrity impacts. Since no patch or fix is confirmed, affected systems remain at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Drupal Location Selector module if possible. Monitor official Drupal security channels for updates and apply patches promptly once available.