A Teesside ecommerce expert is warning online retailers to check how exposed their websites are, after a sharp rise in security flaws affecting WordPress.
It comes after a string of cyber attacks on UK retailers this month, including Asos and the owner of Hobbs, Whistles and Phase Eight, and as card-skimming gangs continue to target online shops running WooCommerce.
Leigh Holland, co-founder of Shopify agency LionheartMarketing.co.uk, says the agency has seen an increase in enquiries during the last three months from retailers worried about being hacked. Leigh believes many smaller online shops don’t realise how much of their security now depends on add-ons built by third parties.
The warning follows the Patchstack’s State of WordPress Security in 2026 report, which identified 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42% on the year before. Nine in ten were in plugins, the add-ons most online shops rely on for payments, delivery and marketing.
Almost half (46%) had no fix available when they were made public, and the most heavily targeted flaws were being mass exploited within a median of five hours.
In July 2026, WordPress itself rushed out an emergency update, forcing automatic installs to close a flaw in its core software that let attackers take over a site without logging in. Across the UK, the government’s Cyber Security Breaches Survey 2025/2026 found 43% of businesses identified a breach or attack in the past year.
“Retailers are more scared of a breach than a migration”
Leigh said: “We’re hearing from more retailers who’ve read about these attacks and want to know if they’re at risk. Most brands are nervous about website migrations, and they should be, because it’s a huge risk. But hackers are getting cleverer, and for a small business a breach can mean losing everything. We’re now seeing retailers decide they’re more worried about a breach than about the move.”
“For a small team, that’s a lot to carry,” added Leigh. “You’re relying on dozens of plugins built by different people, and any one of them could be the way in. If you’re taking card payments, you have to be honest about who’s protecting your customers’ data. For a growing retailer, that answer should be the platform, not a plugin.”
Payment security is a big part of the concern. Shopify is certified as a PCI DSS Level 1 service provider, the highest tier of the card industry’s security standard, and that certification covers the platform’s checkout for every store. On a self-hosted WordPress shop, keeping payments secure and plugins patched sits largely with the retailer.
Three questions to ask now
Leigh is urging online retailers to ask how many plugins their site depends on, who is responsible for updating them, and what a day offline would cost the business.
“WordPress is a great tool for lots of businesses,” said Leigh. “But if you can’t answer those questions quickly, that’s your warning sign. Don’t wait for a breach to find out.”
One retailer that made the move
Leigh said: “One of the retailers we’ve helped is All About Party Bags, a family-run retailer which has sold party bags for more than 25 years and competes with Amazon and Temu. The team was worried about security and was paying a retainer just to keep its plugins up to date.”
“We’d talked about Shopify with them for a while, but in the end they decided the risk of being hacked was bigger than the risk of moving a live store. We moved more than 1,600 products, along with customer records, past orders and blog content, and mapped every old URL to protect their search visibility. We also replaced a back end so slow the team had stopped using it. In the first 30 days on Shopify, their conversion rate rose by 51%, from 1.48% to 2.24%, and search impressions went up by 7,900.”
AI won’t plug the gaps
Leigh also cautions retailers against assuming new AI tools will spot problems for them. “A lot of brands have plugged AI in and think it’s doing everything,” said Leigh. “It’s like hiring a graduate and making them chief marketing officer on day one. It gives you great insight, but you need someone who can check what it’s telling you. When we look under the hood, it often isn’t doing what they think.”
