This vulnerability (CVE-2026-48967) is an SQL Injection issue classified under CWE-89 in the Geo Mashup plugin developed by Dylan Kuhn. It affects versions up to 1.13.19 and allows an attacker with low privileges to inject malicious SQL commands due to improper sanitization of input. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported. No vendor advisory or patch is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). The integrity of data is not affected according to the CVSS vector. The vulnerability can be exploited remotely over the network by an attacker with low privileges without requiring user interaction. The scope of the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable functionality and apply any available workarounds or input validation controls if possible. Monitor official channels for updates from the vendor.