Product

WooCommerce

1 mentions in 7 days · 3 in 30 days · 4 total · first seen Aug 17, 2026 · last 6d ago

Timeline4 articles

Automattic's board forces CEO Matt Mullenweg into leave of absence

Automattic's board voted to place CEO Matt Mullenweg on paid leave against his will, naming CFO Mark Davies interim CEO of WordPress's parent company.

Automattic's board voted to put founder and CEO Matt Mullenweg on paid leave against his will, with CFO Mark Davies appointed interim CEO; Mullenweg remains on the board. The move follows years of turmoil, including a protracted legal battle with WP Engine, a 2024 ultimatum in which 159 employees took severance, and a 16% staff layoff in April 2025. WordPress.org's executive director said the open-source WordPress project and its teams continue as planned and are not impacted. Automattic also owns Tumblr, WooCommerce, and Pocket Casts.

Hacker News · securityupdated Sep 11, 16:33 UTC · 4d agofirst Sep 9, 23:49 UTC · 6d agoOther 7 sources HN 23↑ · 99 comments

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business NewsSep 4, 03:02 UTC · 12d agoPolicy & legal

Hackers expose donor data from Russian fundraisers for Ukrainians, political prisoners

Hackers breached the Stripe-WooCommerce integrations of Russian fundraisers Davayte and You Are Not Alone, exposing donor emails and partial card details.

Unknown hackers accessed the payment accounts of two Russian fundraising projects, Davayte and You Are Not Alone, in mid-August via a shared Stripe-WooCommerce integration used to run online auctions. Exposed data included donor email addresses and, in some cases, the last four digits of payment cards and issuing bank names; full card numbers, cardholder names, and donation details were not taken. Stripe blocked the unauthorized access before the entire donor email database could be downloaded and found no evidence of fraudulent transactions. Attribution remains unclear, with organizers unable to rule out Russian security services; both groups are designated 'undesirable' organizations in Russia, making donor identities sensitive, and a separate alleged leak of data from 669 Stripe merchants by a hacker named 'Satanic' has no confirmed connection.

The RecordSep 2, 13:06 UTC · 13d agoData breach

[webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

An unauthenticated arbitrary file upload exploit was released for a WooCommerce component version 1.5.0, risking site compromise.

Exploit-DB published exploit #52642 targeting WooCommerce 1.5.0. The flaw allows unauthenticated arbitrary file uploads, which can lead to remote code execution on affected web servers. The disclosure text does not report exploitation in the wild.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Appears with

victim You Are Not Alone 2 vendor Stripe 2 vendor WordPress 2 vendor Automattic 2 victim Davayte 2 vendor WooCommerce 2 organization Kommersant 1 organization CitizenLab 1 malware Pegasus 1 organization TechCrunch 1 organization TV Rain 1 organization WordPress Foundation 1 organization WordPress.org 1 organization WP Engine 1 organization SHARE Foundation 1 organization Automattic 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.