LONDON — UK small e-commerce businesses running on WordPress have suffered estimated losses exceeding £42 million in the first seven months of 2026 due to unpatched plugin and theme vulnerabilities.
With WordPress powering a vast majority of small business web stores, automated bot networks are targeting outdated plugins to execute checkout hijacking, database leaks, and site defacement. Official UK security data reveals that affected small merchants face average direct losses of £2,500 to £5,000 per incident—factoring in emergency developer repairs, lost sales during downtime, and long-term SEO penalties.
Cybersecurity experts urge store owners to implement weekly update schedules, automated off-site backups, and web application firewalls to safeguard revenues ahead of the Q4 shopping period.
