CVE-2026-6079 is a missing authorization vulnerability (CWE-862) in the Material Dashboard WordPress plugin by ho3einie. The vulnerability exists because the amd_ajax_target_task_manager() function does not perform capability checks, allowing unauthenticated attackers to access the public_amd_ajax_handler AJAX action to enumerate all scheduled tasks, execute arbitrary tasks, and delete any task. This affects all versions up to and including 1.4.10.

An attacker without authentication can enumerate scheduled tasks, potentially exposing sensitive information such as PII. Additionally, the attacker can execute arbitrary tasks or delete tasks, which may disrupt normal plugin operations and affect availability and integrity of scheduled tasks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the AJAX handler if possible or disable the vulnerable plugin to prevent exploitation.