A global alert around vulnerable content management systems shows how one outdated extension can turn a routine website into an incident response problem.