Thank you Andrea. You've also made some good points as well. Obviously storing WordPress on a sub-domain would seem to be the safest option if the website is an e-commerce site, but having WordPress stored in a separate database really would be a necessity. The last thing you'd want to happen is for their WordPress blog to be hacked and data to be deleted from the blog and the e-commerce system simultaneously.
As far as WordPress vulnerabilities go you need to ensure you use trusted and highly used plugins. There is a plugin called WP Security Scan (http://wordpress.org/extend/plugins/wp-security-scan) that might outline ways you could secure the blog.
If WordPress security is a potential concern here are a few things I would recommend doing (or getting your hosting company to do for you):
1: Password protect the wp-admin directory with a .htaccess fileBy password protecting the WordPress admin area, if a malicious user tries to access your WordPress admin area login page to launch a brute-force attack, or any other file which resides in the wp-admin directory to send a harmful crafted HTTP request, he is greeted with a server side login prompt and no direct access to WordPress files is possible. Something like this should do, but feel free to suggest improvements:
_ AuthUserFile /etc/httpd/.htpasswd__ AuthType Basic__ AuthName “restricted”__ Order Deny,Allow__ Deny from all__ Require valid-user__ Satisfy any_2: Change the wordpress table prefix from wp_ to something else.This will make sure that a malicious user cannot insert wp_<table_name<strong>> into their scripts to compromise the database.</table_name<strong>3: Install and use the Login LockDown plugin to restrict failed login attempts (brute force attacks) http://wordpress.org/extend/plugins/login-lockdown/4: Don't use 'admin' account and use strong passwords.http://www.safepasswd.com is good for generating strong passwords if required.
5. Restrict access to /wp-admin to known IP addresses (Public Home IP and a Public Work IP for instance)
Put a .htaccess file in /wp-admin with the following:
Order Deny,Allow
Deny from all
Allow from xx.xx.xx.xx
Allow from xx.xx.xx.xx
You can use whatismyip.com to file the ip addresses you want to use and just update it as necessary