CVE-2026-126735

This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for your Campaign Monitor. It manages lists through a block on your Drupal site.

The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its admin routes.

This vulnerability is mitigated by the fact that an attacker must craft and embed into a Drupal site a link with exact ID of a Campaign Monitor list for user with administer campaignmonitor permission to click.