---
title: "Stitch Warns Merchants After WordPress And PHP Attacks"
description: "Stitch warned online merchants about October WordPress and PHP attacks and said it temporarily blocked payment access on vulnerable client sites."
canonical_url: "https://liners.com/news/stitch-wordpress-php-attacks-merchant-security-warning"
markdown_url: "https://liners.com/news/stitch-wordpress-php-attacks-merchant-security-warning.md"
type: "article"
language: "en"
published_at: "2026-11-03T18:53:21.991Z"
updated_at: "2026-11-03T18:53:26.527Z"
---

# Stitch Warns Merchants After WordPress And PHP Attacks

Stitch warned online merchants about October WordPress and PHP attacks and said it temporarily blocked payment access on vulnerable client sites.

## Breadcrumbs

- [News](/news)
- [Stitch Warns Merchants After WordPress And PHP Attacks](/news/stitch-wordpress-php-attacks-merchant-security-warning)

## Related articles

- [Stitch Express Payouts To Let Merchants Pay From Balance](/news/stitch-express-payouts-pay-from-balance)
- [Stitch Pulse Launches AI Analytics Suite for Enterprises](/news/stitch-pulse-ai-analytics-suite-launch)
- [Stitch Case Study: OneDayOnly Improves Payment Success 5%](/news/stitch-onedayonly-payments-case-study-5-percent-success-rate)
- [Access Holdings H1 2026 Profit Before Tax Rises 29.2%](/news/access-holdings-h1-2026-unaudited-results-profit-before-tax)
- [Tiger Brands Says Old Mutual Stake Has Reached 5.02%](/news/tiger-brands-old-mutual-stake-5-02)

## Content

## In Short
Stitch said October security attacks on WordPress and PHP put online stores at risk.

The company outlined steps merchants can take to protect their stores. Stitch also said it temporarily prevented payments from being accessed at vulnerable client sites until merchants confirmed their software had been updated.

## What Happened
[Stitch](/stitch) said attackers exploited serious security flaws in WordPress and PHP within hours of the issues being found.

WordPress fixed a flaw on 28 October that affected “almost every WordPress site” running versions 4.7 to 7.1.3. Stitch said the flaw could let an attacker take control of a website without needing a password. WordPress released a fix in version 7.1.4, but users on earlier versions needed to install the update.

Stitch said attacks began at scale within hours of the fix. It cited a security firm, Wordfence, which blocked nearly 63,000 attacks in a single day.

Stitch also pointed to a separate wave of PHP attacks known as PHP2Shell. It said researchers counted about 5.1 million servers running PHP, including more than half a million WordPress sites. It said businesses were told to update servers immediately, or take sites offline until they could. Stitch added that a similar flaw also hit Node.js in the same week.

## Why It Matters
Stitch said an online store is tied to a payment provider, a bank account, and customer details. If attackers take over a site, Stitch said they could use that access to try to move funds out of the merchant’s account and gain access to customers’ personal or card details.

Stitch said this creates financial risk, data risk, and reputation risk. It also noted that customer data in South Africa is protected by law under POPIA.

Stitch added that attackers use automated tools to scan the internet for sites running old software, and that attacks are getting faster. It said some October attacks started before a fix was available, and linked the speed partly to AI, meaning artificial intelligence tools that can help find flaws faster.

Stitch shared practical steps for merchants, including updating WordPress, plugins, and themes quickly, backing up sites, and deleting unused plugins, themes, and admin accounts.

## Sources and products

- [stitch.money](https://stitch.money/blog/what-octobers-wordpress-and-php-attacks-mean-for-your-online-store)
- [Stitch](/stitch)

## Related pages

- [Market Trends](/news)

## Access and citation

- [Canonical HTML page](https://liners.com/news/stitch-wordpress-php-attacks-merchant-security-warning)
- [Markdown route index](/sitemap.md)
- [Agent access guide](/llms.txt)