CVE-2026-91078— TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
Quick assessment
Affected
Unknown TillKit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TillKit WordPress 插件在 1.0.5 版本之前存在安全漏洞。该漏洞的具体描述如下： 在激活插件时，系统会创建一个特权 POS（销售终端）账户，该账户使用一个硬编码且公开已知的 PIN（个人识别码）进行认证。 插件并未强制要求用户在首次使用前更改该 PIN，并且其公开的 POS 登录接口仅依赖该 PIN 进行身份验证，未进行任何用户身份或权限检查。 这种设计导致未授权的攻击者可以通过已知的 PIN 获取特权的 POS 会话，从而读取客户和网站用户个人信息，并修改商店数据。 总结： TillKit W
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91078
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
Source: CVE Program / CVE List V5
Vulnerability Description
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-91078
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91078
请登录查看更多情报信息。
Other References for CVE-2026-91078 (1)
-
https://wpscan.com/vulnerability/7ab037d6-c670-4eaf-be0d-11cc9e20b18e/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-03 · 21 CVEs total
| CVE-2026-86832 | MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API | |
| CVE-2026-101159 | WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission | |
| CVE-2026-101160 | WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating | |
| CVE-2026-80518 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable | |
| CVE-2026-80517 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload | |
| CVE-2026-101161 | WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews | |
| CVE-2026-101162 | WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings | |
| CVE-2026-103293 | MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import | |
| CVE-2026-103514 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay | |
| CVE-2026-86834 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integratio | |
| CVE-2026-94238 | Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter | |
| CVE-2026-85015 | Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Tr | |
| CVE-2026-85568 | Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Paramet | |
| CVE-2026-88782 | Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribu | |
| CVE-2026-88783 | Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content | |
| CVE-2026-92437 | Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion | |
| CVE-2026-89236 | SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Par | |
| CVE-2026-96962 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code | |
| CVE-2026-92923 | Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_ | |
| CVE-2026-94239 | Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
V. Comments for CVE-2026-91078
No comments yet