What is the CVSS score of CVE-2026-6079?

CVE-2026-6079 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of Material Dashboard are affected by CVE-2026-6079?

The Material Dashboard WordPress plugin (versions ≤1.4.10) contains a vulnerability in its task management AJAX endpoint that allows attackers to enumerate, execute, and delete scheduled tasks,…

How to fix or mitigate CVE-2026-6079?

Within 24 hours: immediately disable the Material Dashboard plugin version 1.4.10 or earlier until a patch is released, or restrict access to the `/wp-admin/admin-ajax.php` endpoint containing the vulnerable `amd_ajax_handler` action via firewall or WAF rules. Within 7 days: conduct a security audit of affected sites to identify what task data may have been accessed or modified, review web server access logs for suspicious `amd_ajax_handler` requests, and assess whether sensitive information stored in task parameters was exposed. Within 30 days: monitor vendor advisory for a patched version, prepare a staged rollout plan for the patch once released, or evaluate alternative task management solutions if the plugin is mission-critical.

Material Dashboard CVE-2026-6079

EUVD-2026-53174 HIGH

Missing Authorization (CWE-862)

2026-08-05 Wordfence

GHSA-58hw-xc5c-3pp5

WordPress Authentication Bypass Wordpress Plugin Material Dashboard

7.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-accessible WordPress AJAX endpoint requires no authentication, privileges, or user interaction; impact is low across all three pillars as task data, execution, and deletion remain scoped to the vulnerable system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:47 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

HIGH 7.3

DescriptionCVE.org

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.

AnalysisAI

Unauthenticated access to the Material Dashboard WordPress plugin's task management AJAX endpoint exposes all WordPress sites running versions up to and including 1.4.10 to task enumeration, arbitrary task execution, and task deletion. The root cause is a missing capability check on the amd_ajax_target_task_manager() function, which is registered via the publicly accessible public_amd_ajax_handler AJAX action - reachable without any authentication by design of the hook registration. An attacker can enumerate scheduled tasks (potentially exposing PII stored in task parameters), force arbitrary task execution to trigger unintended server-side operations, or delete tasks to disrupt site functionality. No active exploitation confirmed at time of analysis; no public POC code referenced in available data.

Technical ContextAI

The Material Dashboard plugin (vendor: ho3einie, CPE: cpe:2.3:a:ho3einie:material_dashboard:*:*:*:*:*:*:*:*) implements a custom task scheduling system through the AMDTasks component (core/AMDTasks/AMDTasks.php) exposed via an AJAX network handler (core/AMDNetwork/AMDNetwork.php). The vulnerability is classified as CWE-862 (Missing Authorization): WordPress distinguishes between authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) AJAX hook registrations. When public_amd_ajax_handler is registered without the nopriv guard or when the handler itself omits a current_user_can() capability check, any HTTP client - authenticated or not - can invoke the full task management surface. The affected function amd_ajax_target_task_manager() at AMDTasks.php line 514 handles enumerate, execute, and delete operations without gating on user role or nonce validation, violating WordPress plugin security best practices.

RemediationAI

A fix has been committed to the Material Dashboard plugin repository trunk (WordPress.org SVN changeset 3535650, diff against 3535649 at https://plugins.trac.wordpress.org/changeset?new=3535650%40material-dashboard%2Ftrunk&old=3535649%40material-dashboard%2Ftrunk); however, the exact released plugin version incorporating this fix is not independently confirmed from the available data - site administrators should update to the latest available version via the WordPress dashboard and verify the installed version exceeds 1.4.10. If an update is not immediately possible, a compensating control is to deactivate the Material Dashboard plugin entirely, which removes the AJAX handler registration from WordPress. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with the action=public_amd_ajax_handler parameter will prevent unauthenticated exploitation with minimal side effects, though this may also block legitimate plugin functionality. Given that the AJAX action is publicly registered, network-layer restrictions alone (e.g., IP allowlisting) are not practical compensating controls unless the WordPress admin-ajax endpoint is already restricted.