I use WordPress sometimes and I was impressed by how it "calls home" to get the latest news and updates from the wordpress site.
I also use Prestashop which does the same thing, and yesterday they paid the penalty for this feature...
http://www.prestashop.com/forums/topic/126114-please-read-security-procedure/
...you can never be too vigilant!
A CMS/Online Apps should NEVER as default "call home" except to register (for non-free)
this is a critical error, even worst for a shopping cart!