CVE-2026-6079
7.3 HIGHPublished 2026-08-05 · Updated 2026-08-05
AI risk analysis
- Summary
- The flaw allows unauthenticated attackers to modify and access data through missing capability checks in the Material Dashboard plugin for WordPress.
- Exploitability
- Exploitation is relatively easy as no authentication is required, but attackers need to know the specific task IDs.
- Blast radius
- If exploited, this could lead to unauthorized execution of tasks, deletion of critical data, and exposure of sensitive information.
- Prioritized remediation
- Update the Material Dashboard plugin to the latest version immediately or disable the affected functionality.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-862
All references
- https://plugins.trac.wordpress.org/browser/material-dashboard/trunk/core/AMDNetwork/AMDNetwork.php#L26
- https://plugins.trac.wordpress.org/browser/material-dashboard/trunk/core/AMDTasks/AMDTasks.php#L514
- https://plugins.trac.wordpress.org/changeset?new=3535650%40material-dashboard%2Ftrunk&old=3535649%40material-dashboard%2Ftrunk
- https://www.wordfence.com/threat-intel/vulnerabilities/id/459b7fef-806c-4f5b-bb31-b7197750e941?source=cve
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.