CVE-2026-91078: TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
TillKit WordPress plugin installations running a version before 1.0.5 are affected. The condition arises around the privileged POS account created when the plugin is activated.
Does an attacker need a WordPress account or existing POS access?
No. The public POS login endpoint authenticates on the PIN alone and performs no identity or capability check, so an unauthenticated attacker can obtain a privileged POS session using the publicly known hard-coded PIN.
What can an attacker do after obtaining the POS session?
The attacker can read customer and site-user personal data and modify store data.
How can I determine whether this requires attention?
Check whether the site uses the TillKit WordPress plugin and whether its installed version is earlier than 1.0.5. Sites meeting those conditions should be treated as exposed because the plugin does not require the privileged account PIN to be changed before use.