CVE-2026-6079

HIGH 7.3

Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.

CWE	CWE-862
Vendor	ho3einie
Product	material dashboard
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for ho3einie material dashboard

Be the first to know when new high vulnerabilities affecting ho3einie material dashboard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

ho3einie / Material Dashboard

0 ≤ 1.4.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/459b7fef-806c-4f5b-bb31-b7197750e941?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/material-dashboard/trunk/core/AMDTasks/AMDTasks.php#L514 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/material-dashboard/trunk/core/AMDNetwork/AMDNetwork.php#L26 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?new=3535650%40material-dashboard%2Ftrunk&old=3535649%40material-dashboard%2Ftrunk

Credits

Md. Moniruzzaman Prodhan (NomanProdhan)