Most small businesses have a website, and a growing number sell through it. At the end of October, the three platforms most of them run on all needed attention in the same week, and a well-known retailer showed what happens to stored card details when an online store is breached. None of this needs a specialist. It needs someone to check, this week.
WordPress: the update window
When WordPress updates itself to a new version, it unpacks the new files into a temporary folder before moving them into place. Until 7.1.4, that folder had a predictable name inside wp-content/upgrade and could be reached from the web, and the temporary copy included WordPress's installer. Someone watching for that moment could reach the installer and use it to run their own code, without an account on the site.
It is not easy: the window normally lasts seconds, and Wordfence, which analyzed the flaw, rates it 8.1 out of 10 with high attack complexity. But attackers did not wait. Wordfence saw the first attack attempt nine minutes after it deployed a detection rule on 28 October and more than 18,500 attempts in the first 21 hours, including two sources that repeatedly polled small groups of sites for about 14 hours. No successful compromises have been reported.
The fix randomizes the folder name and adds protections. It was released for every supported branch, back to 4.7.39. Most sites receive it through automatic background updates, but Wordfence's advice is to check rather than assume.
Drupal Commerce: actively exploited
Drupal's security team rated the Commerce Core flaw 21 out of 25, "highly critical." It lets an attacker get around access checks on some routes and fields, in a way Drupal says "may financially impact the vendor," which is to say the store owner. The advisory states plainly that it is being exploited. Fixed versions are 3.3.13 for current sites and 8.x-2.41 for older ones.
Magento: a July fix, exploited now
CVE-2026-48356 lets an attacker upload a dangerous file to an Adobe Commerce or Magento store and potentially run code, if someone with access visits a crafted link. Adobe fixed it in its July bulletin, APSB26-73. CISA's listing on 27 October means attackers are now using it, three and a half months later, against stores that never installed July's update. That gap, between a fix being available and a business installing it, is where most store compromises happen.
Revolve: what stored cards are worth
Revolve, a Los Angeles-area online fashion retailer, said in its SEC filing that an unauthorized actor "may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information" in their online accounts. It has not said how the attacker got in or when, and it does not expect a material impact on its business.
The words "through automated means" and "saved payment information" carry the lesson for a smaller store. Any card details a store keeps itself are worth automating an attack for. A store that lets its payment processor hold the cards, and keeps only a token, has nothing of that kind to lose.
What to actually do
Check your WordPress version today. Go to Dashboard → Updates and confirm the site is on 7.1.4, or the patched release for its branch. Then look in wp-content/upgrade for PHP files you did not put there, and in Users for administrator accounts you do not recognize. If your host allows it, block web access to wp-content/upgrade altogether.
If you run a Drupal store, update Commerce Core now and audit recent orders. Look for orders, prices or discounts you cannot explain since mid-October.
If you run Magento or Adobe Commerce, make sure July's security update is installed. If it is not, that is now an emergency rather than maintenance.
Stop storing card numbers yourself. If your store saves customers' cards, make sure it is the payment processor's vault doing it and not your own database. Ask your developer or platform which it is.
Know who patches your site. Many small businesses assume their web developer, agency or host updates the site. Often nobody does. Write down who is responsible for your website and your store's updates, and how you would know if they had not happened.
The summary
Nothing in this week's list was exotic. A content management system, two store platforms and a retailer's saved cards. What they share is time: the WordPress flaw was being probed within minutes, and the Magento flaw was exploited months after its fix, against stores whose owners never installed it. Ten minutes checking your site's version this week is the cheapest security you will buy this year.
Sources
- WordPress 7.1.4 security release — WordPress.org
- WordPress 7.1.4 security release: remote code execution — Wordfence
- Fresh WordPress vulnerability in attackers' crosshairs — SecurityWeek
- Commerce Core: highly critical access bypass, SA-CONTRIB-2026-254 — Drupal Security Team
- Drupal warns of critical Commerce Core flaw exploited in attacks — BleepingComputer
- CISA adds two known exploited vulnerabilities to catalog — CISA
- Revolve Group Form 8-K — SEC
- Revolve discloses breach of saved payment cards — The Record
