Authentication Bypass in TillKit WordPress Plugin by TillKit
CVE-2026-91078
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-91078?
The TillKit WordPress plugin, prior to version 1.0.5, creates a privileged POS account with a hard-coded PIN known publicly. This design flaw permits unauthenticated attackers to exploit the public POS login endpoint, gaining access to a privileged POS session without undergoing necessary identity or capability checks. As a result, attackers can read sensitive customer and site user personal data, as well as modify store-related data, significantly compromising the security and integrity of the site.
Affected Version(s)
TillKit 0 < 1.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.