{"id":"CVE-2026-91078","published":"2026-10-03T06:16:45.507","lastModified":"2026-10-06T15:18:12.170","description":"The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/7ab037d6-c670-4eaf-be0d-11cc9e20b18e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in TillKit WordPress plugin allows unauthenticated attackers to obtain a privileged Point of Sale (POS) session, leading to unauthorized access to customer and site-user personal data and potential store data modifications.","exploitability":"Exploitation is relatively easy as the PIN is publicly known and no identity or capability check is performed during authentication.","blast_radius":"If exploited, the impact could be severe, as it allows attackers to read sensitive customer and user data, and potentially modify store data.","remediation":"Upgrade to TillKit version 1.0.5 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","data-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-04T08:41:31.432Z"}}