The Easy Email Subscription WordPress plugin versions up to and including 1.3 suffer from a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in the show_editsub_page() function. This flaw allows unauthenticated attackers to trick site administrators into performing actions that delete arbitrary subscribers via forged requests.