The TillKit WordPress plugin creates a privileged point‑of‑sale account with a hard‑coded, publicly known PIN during activation and fails to require the PIN be changed before use. The public POS login endpoint authenticates a user solely on that PIN, with no additional identity or capability verification. This flaw enables an attacker to supply the known PIN and obtain a privileged POS session, read customer data, view site‑user personal information, and modify store inventory or transactions.

All installations of the TillKit WordPress plugin from the unknown vendor identity that are running a version earlier than 1.0.5 are impacted. The plugin provides POS functionality for WordPress sites, and any site using this plugin without upgrading is exposed.

The vulnerability offers a remote, unauthenticated attack vector that requires only knowledge of the hard‑coded PIN. The CVSS score of 8.2 classifies it as high severity, and the EPSS score of < 1% indicates a low but non-zero exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers can trigger the vulnerable endpoint with a simple HTTP request, making exploitation extremely low effort and easily automated. The resulting compromise can reveal sensitive customer and site‑user data and allow full control of store operations.