Admin-level holes in websites are always a bad thing... and for "bad", read "worse" if it's an e-commerce site.