Tillkit
Monthly
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.
Unauthenticated attackers can seize a privileged point-of-sale session on WordPress sites running the TillKit plugin before 1.0.5, letting them read customer and site-user personal data and modify store records. On activation the plugin creates a privileged POS account protected by a hard-coded, publicly known PIN that it never forces administrators to change, and its public POS login endpoint authenticates on that PIN alone with no identity or capability check (CWE-287); the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms this is remotely reachable with no credentials and no user interaction. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so real-world urgency depends on whether TillKit is actually deployed and whether the default PIN is still in place.