Sponsored by
Happy Sunday! A Magento backdoor can run code without a login, turning a routine checkout path into an urgent merchant investigation. The fix may protect the store; the interim workaround can disrupt the journey it is meant to save.
News
1️⃣ Magento backdoor puts checkout at risk
2️⃣ Lotte turns supermarket shelves into dispatch points
3️⃣ Bonds turns resale into the next purchase
Insights
4️⃣ ChatGPT weakens the listicle playbook
5️⃣ TikTok growth claims need testing
6️⃣ Poland needs its own assortment
LET’S ENTER THE MAZE!
1️⃣ News
The Maze: StyleSmuggler lets outsiders run code on Magento store servers without logging in, with attacks hitting a patched store and a new backdoor variant found September 6.
Ecommerce-security firm Sansec reproduced attacks on fresh installations, showing that an up-to-date store can still need urgent investigation.
The code runs as a failed-payment email is generated, so nobody needs to open the message; the investigation found a backdoor but did not establish payment theft.
Temporarily disabling GraphQL, an interface used for customer purchases, is Sansec's fallback for stores without its Shield protection, but can disrupt dependent checkouts.
Why it matters: Merchants face two linked checks: whether attackers got inside, and which buying journeys temporary protection could interrupt while a fix remains unverified.
2️⃣ News
The Maze: Lotte Super, a South Korean supermarket chain, joins Coupang Eats with about 170 stores, turning existing shelves into dispatch points for app-based grocery orders.
The September 7 rollout offers about 3,000 grocery, household and deli items, with a KRW15,000 minimum order aimed at small households.
Store staff pick orders for riders, targeting 15-minute preparation and delivery within one hour of ordering, with timing dependent on distance.
Nearby stores provide the stock, while the app provides the ordering route, making profitable growth depend on extra sales covering the work each basket creates.
Why it matters: Lotte can gain orders from its existing stores, while Coupang gains another shopping occasion; picking labor and service costs will decide the value of each basket.
3️⃣ News
The Maze: Bonds has opened Australian seller listings for used baby and kids clothing, with buying to follow; its payout choices encourage families to shop with the brand again.
Bonds' internal tracking found over 30,000 unofficial listings on Facebook groups and eBay, giving Village Marketplace an existing resale audience to pursue.
Treet, the resale platform partner, offers sellers 100% of the item price in Bonds credit or 80% in cash, with the cash fee paid to Treet.
Buyers pay shipping, so an attractive used-clothing price still has to survive postage before it becomes a worthwhile order.
Why it matters: Bonds can turn resale proceeds into the next purchase, but the real test is whether buyers and sellers get enough value after fees and postage.
4️⃣ Insight
The Maze: Listicles and comparison pages lost citation share in Peec AI's paired-week ChatGPT study, exposing the risk of building a content strategy around one winning format.
Listicles fell from 15.77% to 7.80% of citations, a 50.5% relative decline, rather than a 50.5 percentage-point loss.
Comparison pages dropped from 9.08% to 6.17%, a 32.1% reduction in share, while still earning citations.
Retrieved sources per chat roughly doubled, so operators must distinguish a shrinking slice from lost citations before treating a format change as a sales signal.
Why it matters: Diversify useful content, then track citations and purchases separately: a smaller citation share reveals exposure, not a proven loss of customers or revenue.
5️⃣ Insight
The Maze: Amazon brands with TikTok Shops show much faster revenue growth, but selecting already-successful sellers makes the apparent advantage harder to interpret.
Among 10,000 leading Amazon brands, 1,309 matched shops underpin a 5.2× average annual growth-rate comparison, with geography and the exact period undisclosed.
Raising the minimum monthly TikTok revenue filter selects groups growing roughly 22.5%–30%, versus about 5% without shops, rather than tracking one brand's progress.
TikTok discovery can feed purchases elsewhere, but controlled comparisons help separate extra demand from stronger sellers simply choosing the channel.
Why it matters: Measure extra profit across the business, including creator costs and discounts, before treating a cross-channel growth association as a budget multiplier.
6️⃣ Insight
The Maze: Poland’s online sales lean toward hobby and leisure, while fashion takes half Germany’s share; copying a neighboring market’s category plan risks misallocating spend.
Hobby and leisure takes 30% of Polish online revenue, just above electronics and fashion combined at 29%.
Fashion’s 12% share compares with Germany’s 24%, Austria’s 23% and Switzerland’s 26%, making a regional template a poor allocation guide.
These are revenue shares, not shopper counts or proof that trust causes the gap, so local conversion and returns economics still need testing.
Why it matters: Build Poland’s assortment around local demand, then test profit after returns; a low fashion share signals a question to investigate, not guaranteed headroom.
🗞️ Quick hits
Everything else you should know
📣 Attention economics shift
TikTok drew higher back-to-school budgets in separate agency samples, making creator-led discovery a bigger allocation question without proving platform-wide spend growth.
Yotpo Discover found Tesco in 25.3% of monitored AI-search responses, showing grocers that product discovery is becoming a visibility problem before it becomes a traffic metric.
⚖️ Platform controls move upstream
Australia proposed an opt-out from recommendation algorithms, a planned rule that could make platform distribution more configurable for users and more complex for advertisers.
🛒 Marketplaces add monetization and protection
CDON partnered with Topsort on sponsored-product infrastructure, giving its Nordic marketplace another way to monetize seller demand if the reported deployment becomes operational.
Coupang extended Ansim Care repair protection to Rocket Install furniture, adding a paid post-purchase service where the three-year period includes the manufacturer warranty.
💄 Ownership and autonomy stay conditional
THAT’S IT FOR TODAY!
You’re the reason our team spends hundreds of hours every week researching and writing this email.
What do you think of this issue?
See you next time in the maze!
MarketMaze team
