TillKit WordPress Plugin CVE-2026-91078

No special conditions beyond the plugin being installed and active: exploitation requires only that a site runs TillKit before version 1.0.5 and that the POS account's hard-coded PIN has not been manually changed after activation - which the plugin does not force, so default/activation state is vulnerable. The specific prerequisite is reaching the plugin's public-facing POS login endpoint over the network and submitting the publicly known PIN; no account, credential, or user interaction is needed. The main limiting factor is scope: a site administrator who manually changed the default PIN after activation would not be exposed, and impact is bounded to store/POS data and the customer and site-user personal data accessible to a privileged POS session rather than full WordPress admin or host compromise.

This is a genuine high-priority issue for any site actually running the TillKit plugin, though real-world urgency is tempered by low deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the cleanest possible exploitation path - remote, low-complexity, unauthenticated, no user interaction - and the root cause (CWE-287, a hard-coded publicly known PIN gating a privileged POS login endpoint with no identity or capability check) matches that vector exactly, so the signals are internally consistent rather than conflicting. Publicly available exploit code exists (per WPScan), and SSVC marks the flaw Automatable:yes with partial technical impact, reinforcing that mass/scripted abuse is feasible. However, EPSS is only 0.14% (3rd percentile) and SSVC Exploitation is 'none' - there is no evidence of active exploitation, and the vulnerability is NOT in CISA KEV. The low EPSS despite trivial exploitability is best explained by small installed base rather than by any technical barrier: the attack is easy, but few targets exist. Net: treat as a prompt patch priority where deployed (easy, unauthenticated, POC-backed), but it is not a widespread internet-wide emergency.

An unauthenticated attacker locates a WordPress site running TillKit (<1.0.5) and sends a request to the public POS login endpoint supplying the plugin's hard-coded, publicly documented PIN, which was never forced to be changed on activation. Because the endpoint authenticates on the PIN alone with no identity or capability check, the attacker obtains a privileged POS session and can read customer and site-user personal data and modify store data. Public exploit code exists, and the low attack complexity (AC:L) with no required interaction makes this scriptable at scale.