CVE-2026-13242

CVE-2026-13242: Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

Vendor Drupal

Product Geolocation Field

Weakness CWE-89 · SQLi

Published July 10, 2026

Last update July 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

Key dates

02Disclosure timeline

July 10, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-13242 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-61950 WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability CVE-2026-59526 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability CVE-2026-65532 WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability CVE-2026-65526 WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability CVE-2026-25405 WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability