WordPress Plugin Hardcoded PIN Enables Privileged Account Takeover

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The TillKit WordPress plugin contains a critical authentication bypass vulnerability where it creates a privileged POS (Point of Sale) account with a hardcoded, publicly known PIN during activation. The plugin fails to enforce PIN changes before deployment and relies solely on this weak credential for authenticating access to sensitive POS endpoints. This vulnerability affects WordPress sites running TillKit before version 1.0.5, exposing customer personal data, site user information, and enabling unauthorized modification of store data. Attackers require no legitimate credentials—only knowledge of the hardcoded PIN—to gain privileged administrative access to e-commerce functionality.

Casky's 283 mapped skills leverage Claude AI with extended reasoning to identify this attack pattern across multiple MITRE ATT&CK technique areas. Within TA0004 (Privilege Escalation), practitioners would detect anomalous POS session creation without corresponding legitimate authentication events, and unusual privilege escalation from unauthenticated requests. Under TA0006 (Credential Access), Casky skills flag the use of hardcoded credentials in plugin code, suspicious PIN-based authentication patterns, and compromised session tokens being used to access customer databases. By analyzing behavioral indicators—unauthenticated API calls to `/wp-admin/` POS endpoints, database queries accessing customer records without proper session validation, and configuration changes made through default credentials—Casky's extended reasoning capabilities help practitioners distinguish legitimate POS operations from exploitation attempts, enabling rapid detection and response.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-91078.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-91078

Casky has 283 skills that investigate the attack patterns behind CVE-2026-91078. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn