CVE-2025-10691: WordPress Easy Email Subscription CSRF

CVE-2025-10691 Overview

CVE-2025-10691 is a Cross-Site Request Forgery (CSRF) vulnerability in the Easy Email Subscription plugin for WordPress, affecting all versions up to and including 1.3. The flaw stems from missing or incorrect nonce validation in the show_editsub_page() function. Unauthenticated attackers can delete arbitrary subscribers by tricking an authenticated administrator into clicking a crafted link. The weakness is classified under [CWE-352]. Exploitation requires user interaction but no attacker privileges, and impacts data integrity within the subscriber list.

Critical Impact
Successful exploitation allows unauthenticated attackers to delete arbitrary email subscribers on affected WordPress sites when an administrator is socially engineered into clicking a forged request.

Affected Products

Easy Email Subscription plugin for WordPress — all versions through 1.3
WordPress sites using the email-subscription-with-secure-captcha plugin slug
Administrator sessions on affected installations

Discovery Timeline

2025-11-06 - CVE-2025-10691 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10691

Vulnerability Analysis

The Easy Email Subscription plugin exposes an administrative action handler, show_editsub_page(), that processes state-changing requests without enforcing a valid WordPress nonce. WordPress nonces are single-use tokens that bind a request to a specific user session and action, and their absence removes the primary anti-CSRF control the platform provides.

Because the handler accepts subscriber deletion parameters without verifying request origin, any HTTP request delivered under an authenticated administrator's session cookies is treated as legitimate. An attacker can host a page containing an image tag, form auto-submit, or link that targets the vulnerable endpoint. When an administrator visits the attacker-controlled resource, the browser attaches session credentials and the deletion executes server-side.

The vulnerability does not disclose data or grant code execution, but it corrupts the subscriber database and undermines the integrity of the plugin's core functionality.

Root Cause

The root cause is missing or malformed nonce validation in the show_editsub_page() function. WordPress developer guidance requires check_admin_referer() or wp_verify_nonce() on any privileged action, and the affected code path omits this check. As a result, the plugin relies solely on cookie-based authentication, which browsers submit automatically on cross-origin requests.

Attack Vector

The attack is delivered over the network and requires user interaction from a privileged WordPress user. A typical exploitation flow involves an attacker sending a phishing email or embedding a hidden request on a page controlled by the attacker. When the target administrator is logged into the WordPress dashboard and interacts with the malicious content, the browser issues an authenticated request to the vulnerable endpoint, deleting subscriber records selected by the attacker.

The vulnerability manifests entirely in the plugin's administrative handler and does not require prior authentication or knowledge of internal identifiers beyond what an attacker can enumerate or guess. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-10691

Indicators of Compromise

Unexpected subscriber deletions in the Easy Email Subscription plugin database tables
Web server access logs showing requests to show_editsub_page handler with external Referer headers
Administrator activity records with subscriber deletion actions occurring shortly after external link clicks

Detection Strategies

Audit web access logs for POST or GET requests targeting the plugin's admin endpoints without valid _wpnonce parameters
Correlate subscriber deletion events with administrator browsing history and referrer data
Deploy web application firewall rules that inspect requests to wp-admin endpoints for missing or malformed nonce tokens

Monitoring Recommendations

Enable WordPress audit logging plugins to record all administrative state changes with source IP and referrer
Alert on off-hours administrative actions or bulk subscriber removal events
Monitor outbound email delivery volume drops that may indicate silent subscriber list tampering

How to Mitigate CVE-2025-10691

Immediate Actions Required

Update the Easy Email Subscription plugin to a version later than 1.3 that includes the nonce validation fix from WordPress Plugin Change Log
If no patched version is available for your deployment, deactivate and remove the plugin until a fix is applied
Review subscriber tables for unauthorized deletions and restore from backup if tampering is detected

Patch Information

The plugin vendor addressed the missing nonce validation in changeset 3388578 on the WordPress plugin repository. Administrators should apply the update through the WordPress dashboard or by installing the patched plugin package directly. Verify the installed version reports higher than 1.3 after the update.

Workarounds

Restrict administrator dashboard access to trusted IP ranges using web server or firewall rules
Require administrators to use separate browsers or browser profiles when accessing the WordPress dashboard to reduce cross-site request exposure
Train administrators to avoid clicking untrusted links while logged into the WordPress admin panel

bash

# Example: block requests to the vulnerable endpoint without a nonce parameter (nginx)
location ~ /wp-admin/admin\.php {
    if ($arg_page = "show_editsub_page") {
        if ($arg__wpnonce = "") {
            return 403;
        }
    }
}