Yup, that's an attack that exists and is used regularly. It's not trivial to pull off, but is easy/accessible enough that competitors will sometimes do this to each other's web shops (I've heard of two cases of this just in last 3 years and that's in a city of only 300k people).