The problem is that Magento releases and patches to address vulnerabilities are supplied separately, ie, the user must install the release, and then track the emergence of patches and apply them. Many users appreciate the relevance of their Magento system version number and do not care about installing patches, potentially making them vulnerable system. For example, the proposed currently Magento 1.9.1.0 release does not include the fix.

We strongly recommend that you immediately patch your sites on Magento. Download patches for different versions of the system can be here.

For help, you can always contact our support team.