CVE-2026-6079: CWE-862 Missing Authorization in ho3einie Material Dashboard
The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.
AI Analysis
Technical Summary
CVE-2026-6079 is a missing authorization vulnerability (CWE-862) in the Material Dashboard WordPress plugin by ho3einie. The amd_ajax_target_task_manager() function lacks proper capability checks, enabling unauthenticated attackers to access the public_amd_ajax_handler AJAX action to enumerate scheduled tasks, potentially exposing personally identifiable information (PII), execute arbitrary tasks, and delete any scheduled task. This affects all versions up to and including 1.4.10. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity.
Potential Impact
An attacker without authentication can enumerate all scheduled tasks, which may expose sensitive information such as PII. Additionally, the attacker can execute arbitrary scheduled tasks and delete any task, potentially disrupting normal operations or causing data loss.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the AJAX handler if possible or disable the plugin to prevent exploitation.
CVE-2026-6079: CWE-862 Missing Authorization in ho3einie Material Dashboard
Description
The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.
CVSS v3.1
Score 7.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-6079 is a missing authorization vulnerability (CWE-862) in the Material Dashboard WordPress plugin by ho3einie. The amd_ajax_target_task_manager() function lacks proper capability checks, enabling unauthenticated attackers to access the public_amd_ajax_handler AJAX action to enumerate scheduled tasks, potentially exposing personally identifiable information (PII), execute arbitrary tasks, and delete any scheduled task. This affects all versions up to and including 1.4.10. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity.
Potential Impact
An attacker without authentication can enumerate all scheduled tasks, which may expose sensitive information such as PII. Additionally, the attacker can execute arbitrary scheduled tasks and delete any task, potentially disrupting normal operations or causing data loss.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to the AJAX handler if possible or disable the plugin to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-04-10T14:38:08.263Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a72e5c9bf8831d539735128
Added to database: 08/05/2026, 07:27:05 UTC
Last enriched: 08/05/2026, 07:43:45 UTC
Last updated: 08/06/2026, 02:07:10 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.