CVE-2026-91078

Name of the Vulnerable Software and Affected Versions TillKit WordPress plugin versions prior to 1.0.5

Description The plugin creates a privileged POS account upon activation that uses a hard-coded, publicly known PIN. The system does not require this PIN to be changed before use and authenticates the public POS login endpoint based solely on this PIN without performing identity or capability checks. This allows unauthenticated attackers to obtain a privileged POS session to read personal data of customers and site users, as well as modify store data.

Recommendations Update TillKit WordPress plugin to version 1.0.5 or later.