CVE-2026-6079: Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the publicamdajaxhandler AJAX action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Material Dashboard pluginto a version that resolves this vulnerability.Fixed in 1.4.10 - Compensating control
Ensure only authenticated, authorized users can access the public_amd_ajax_handler AJAX action; block or restrict unauthenticated requests and enforce WordPress capability checks for task management operations.