WordPress TillKit plugin < 1.0.5 - Unauthenticated POS Takeover vulnerability

Unauthenticated POS Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin TillKit versions 1.0.5...

CVE-2026-91078

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-91078

The TillKit WordPress plugin versions prior to 1.0.5 is vulnerable to an unauthenticated POS takeover. The root cause is that the plugin creates a privileged POS account during activation with a hard-coded, publicly known PIN and does not require this PIN to be changed. The public POS login endpo...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

EUVD-2026-91944

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-91078: Improper Authentication

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

PT-2026-104530

Name of the Vulnerable Software and Affected Versions TillKit WordPress plugin versions prior to 1.0.5 Description The plugin creates a privileged POS account upon activation that uses a hard-coded, publicly known PIN. The system does not require this PIN to be changed before use and authenticate...