CVE-2026-91078

Summary

The flaw in TillKit WordPress plugin allows unauthenticated attackers to obtain a privileged Point of Sale (POS) session, leading to unauthorized access to customer and site-user personal data and potential store data modifications.

Exploitability

Exploitation is relatively easy as the PIN is publicly known and no identity or capability check is performed during authentication.

Blast radius

If exploited, the impact could be severe, as it allows attackers to read sensitive customer and user data, and potentially modify store data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TillKit version 1.0.5 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.