The Easy Email Subscription plugin for WordPress contains a Cross‑Site Request Forgery flaw stemming from the absence or mis‑implementation of nonce checks in the show_editsub_page() routine. An unauthenticated attacker can craft a forged request that, if executed by a site administrator, will delete any subscriber record. This flaw does not allow code execution but results in loss of user data and potential disruption of subscription services.

All installations of the Easy Email Subscription plugin by yudiz with versions 1.3 and earlier are affected. No further version details are provided beyond the <=1.3 constraint.

The CVSS score of 4.3 indicates a moderate severity risk. The EPSS score, being in the less than 1% bracket, suggests a very low likelihood of exploitation at the time of analysis. The flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to socially engineer an administrator into clicking a malicious link or submitting a forged form; no privileged or authenticated access is required to carry out the deletion.