CVE-2026-6079: WordPress Material Dashboard Auth Bypass

CVE-2026-6079 Overview

CVE-2026-6079 is a missing authorization vulnerability [CWE-862] in the Material Dashboard plugin for WordPress. The flaw affects all versions up to and including 1.4.10. The amd_ajax_target_task_manager() function lacks capability checks, allowing unauthenticated attackers to abuse the public_amd_ajax_handler AJAX action. Attackers can enumerate scheduled tasks, execute arbitrary tasks, and delete any task on affected sites. Task enumeration may expose personally identifiable information (PII) stored in scheduled tasks.

Critical Impact
Unauthenticated network attackers can read, execute, and delete scheduled tasks on any WordPress site running Material Dashboard 1.4.10 or earlier, exposing PII and disrupting site operations.

Affected Products

Material Dashboard plugin for WordPress, versions up to and including 1.4.10
WordPress installations using the public_amd_ajax_handler AJAX action
Sites relying on the plugin's AMDTasks scheduled task subsystem

Discovery Timeline

2026-08-05 - CVE-2026-6079 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-6079

Vulnerability Analysis

The Material Dashboard plugin registers a public AJAX endpoint through the public_amd_ajax_handler action. This endpoint dispatches requests to the amd_ajax_target_task_manager() function defined in core/AMDTasks/AMDTasks.php. The function operates on the plugin's task scheduling data but does not verify the requester's capabilities or authentication state.

An attacker can invoke the AJAX action over the network without credentials. The task manager exposes enumeration, execution, and deletion operations on scheduled tasks. Enumeration returns task metadata that may include PII embedded in task parameters. Execution triggers arbitrary scheduled tasks out of sequence. Deletion removes any task record from the plugin's storage.

Root Cause

The root cause is a missing capability check in amd_ajax_target_task_manager(). WordPress conventions require server-side authorization using functions such as current_user_can() for sensitive AJAX endpoints. The affected handler omits this check and does not validate a privileged nonce. The public AJAX registration in core/AMDNetwork/AMDNetwork.php compounds the issue by exposing the action to unauthenticated visitors through wp_ajax_nopriv_ hooks.

Attack Vector

Exploitation requires only network access to wp-admin/admin-ajax.php on the target site. An attacker sends a crafted POST request specifying the public_amd_ajax_handler action along with parameters that select the task manager operation (list, run, delete) and target task identifier. No authentication, user interaction, or elevated privileges are required. The vulnerability is exploited entirely through the standard WordPress AJAX interface. For technical details, see the WordPress Plugin Code Review for AMDTasks.php and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-6079

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php containing action=public_amd_ajax_handler
Unexpected deletions or executions in the Material Dashboard task log
Access log entries from a single IP enumerating multiple task identifiers via the public_amd_ajax_handler endpoint
Missing or altered scheduled tasks not attributable to administrator activity

Detection Strategies

Alert on any request to admin-ajax.php with action=public_amd_ajax_handler originating from unauthenticated sessions
Correlate task deletion and execution events with the associated WordPress user session; flag events with no logged-in user
Deploy web application firewall (WAF) rules that inspect POST bodies for the vulnerable action parameter

Monitoring Recommendations

Enable verbose access logging on admin-ajax.php and forward logs to a centralized SIEM
Track the frequency and diversity of action parameters per source IP to identify enumeration attempts
Monitor the WordPress plugin's task table for unexpected reductions in row count or unscheduled execution timestamps

How to Mitigate CVE-2026-6079

Immediate Actions Required

Update Material Dashboard to the version released after 1.4.10 that includes the capability check fix; refer to the WordPress Changeset Details
If patching is not immediately possible, deactivate and remove the Material Dashboard plugin
Audit scheduled tasks and task execution logs for signs of unauthorized enumeration, execution, or deletion
Rotate any credentials or secrets referenced within scheduled task parameters that may have been exposed

Patch Information

The vendor addressed the vulnerability by adding capability checks to the amd_ajax_target_task_manager() function. The fix is visible in the plugin trunk changeset 3535650. Administrators should install the fixed release from the WordPress plugin directory and confirm the plugin version reports higher than 1.4.10.

Workarounds

Block requests to admin-ajax.php where the action parameter equals public_amd_ajax_handler using a WAF rule until the plugin is updated
Restrict access to wp-admin/admin-ajax.php at the network layer for known administrator IP ranges where feasible
Disable the Material Dashboard plugin on production sites until the patched version is deployed

bash

# Example WAF rule (ModSecurity) to block unauthenticated exploitation
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026607901,msg:'Block CVE-2026-6079 exploit attempt'"
    SecRule ARGS:action "@streq public_amd_ajax_handler"