The Material Dashboard plugin for WordPress contains a missing capability check in the amd_ajax_target_task_manager() function. As a result, the public_amd_ajax_handler AJAX endpoint can be accessed by any visitor. An unauthenticated attacker can enumerate all scheduled tasks, execute them, or delete them. The flaw may expose personally identifiable information stored in tasks, allow execution of arbitrary code, or disrupt site operations. The weakness is identified as CWE‑862, Missing Authorization.

The affected vendor is ho3einie and the product is the Material Dashboard WordPress plugin. All releases up to and including version 1.4.10 are vulnerable. No other version or product information is available.

The CVSS score of 7.3 reflects a moderate‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly reported exploits yet. However, the lack of authentication on the AJAX endpoint means an attacker can simply send crafted HTTP requests to public_amd_ajax_handler to enumerate, run, or delete tasks, thereby compromising confidentiality, integrity, or availability of the site.