CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
Unauthenticated attackers can use a hard-coded PIN to access the POS interface, allowing them to read customer data and modify store information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91078?
CVE-2026-91078 is a high-severity vulnerability in Unknown TillKit, published on 3 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
Weakness: CWE-287
Which versions are affected by CVE-2026-91078?
How do I fix CVE-2026-91078?
No fix has been published for CVE-2026-91078 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-91078 being exploited?
There is no known exploitation of CVE-2026-91078 in the wild and no public exploit code.
Sources
Also known as GHSA-mhjv-47jj-mxpp.