CVE-2026-91078
High
Description
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
SeverityHigh
CVSS8.2
Exploit probability—
ProductTillKit
PublishedOct 3, 2026
First seenOct 3, 2026
Weakness typeCWE-287Improper authentication
How to fix
Update
- TillKit1.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TillKit | v < 1.0.5 | 1.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.