CVE-2025-10691 is a medium severity Cross-Site Request Forgery vulnerability affecting the Easy Email Subscription plugin for WordPress, versions up to and including 1.3. The issue arises from missing or incorrect nonce validation in the show_editsub_page() function, enabling unauthenticated attackers to delete subscribers by tricking an administrator into executing a forged request. The vulnerability does not impact confidentiality or availability but results in limited integrity loss. No patch or official fix details are currently available.

An attacker can cause an administrator to unknowingly delete arbitrary subscribers from the Easy Email Subscription plugin by exploiting the CSRF vulnerability. This impacts the integrity of subscriber data but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the vulnerable plugin may reduce risk.