Threats tagged 'drupal-contrib-2026-326'

The Drupal Campaign Monitor module before version 3.0.3 is vulnerable to cross-site request forgery (CSRF) on its administrative routes. This flaw allows an attacker to craft a malicious link targeting users with the 'administer campaignmonitor' permission, potentially causing unauthorized actions related to Campaign Monitor list management. Exploitation requires the attacker to embed a link with the exact Campaign Monitor list ID and trick an authorized admin user into clicking it.