WordPress News Roundup April 2008: WordPress 2.5.1 Security Fix and the Monotone Theme at Web 2.0 Expo

April 2008 was about settling in after WordPress 2.5. Plugin authors adapted to the new admin, false security alarms were knocked down, and on April 25 WordPress 2.5.1 shipped with performance fixes and a significant security patch. The same day, Matt Mullenweg used the Web 2.0 Expo in San Francisco to launch new WordPress.com features, including the photo-friendly Monotone theme.

Mergers, Acquisitions, and Investments

Automattic made no acquisitions this month. In the wider blogging world, AOL acquired Sphere, the blog search and related-content company, which Mullenweg noted he had previously advised.

WordPress Core Updates

• WordPress 2.5.1 (April 25): A maintenance release with bug fixes, performance improvements and a significant security fix. The team urged an immediate upgrade, especially for sites with open registration, and noted the vulnerability had not yet been made public.
• Admin colour schemes: Mullenweg asked whether plugins were taking advantage of the colour scheme switcher introduced in 2.5.

Other WordPress News

• Web 2.0 Expo launches: On April 25, Mullenweg announced “Possibly Related Posts” for WordPress.com, which suggested related content beneath posts, and the Monotone theme.
• Identicons: Gravatar began offering identicons, automatically generated patterned images for commenters without an avatar.
• VIP clients: Thomson Reuters moved its announcement site to WordPress.com VIP after the two companies combined, and the US papal visit had its own WordPress.com blog.
• Upcoming WordCamps: The WordPress blog rounded up upcoming WordCamps, including San Francisco.
• An Event Apart: The WordPress blog offered a discount to An Event Apart, the web design conference whose speakers included people who had contributed to 2.5.
• A new ma.tt: Mullenweg relaunched his own site with a spring redesign built on WordPress 2.5.

Security Alerts and Plugin Vulnerabilities

Two security stories ran in parallel. On April 14, Mullenweg said a SQL injection report published via SecurityFocus was bogus, while acknowledging that attackers were targeting blogs running old WordPress versions. Then 2.5.1 fixed a real, undisclosed vulnerability that mainly threatened sites allowing open registration. The message was consistent: upgrade promptly, and treat registration-enabled sites as higher risk.

Industry Trends and Insights

Related-content widgets and visual themes like Monotone reflected a shift toward richer, more visual blogs. Monotone adapted its colours to the photo in each post, a hint that themes could respond to content rather than just display it. AOL’s purchase of Sphere showed large media companies still saw value in blog discovery tools.

Theme of the Month: Monotone

Launched on WordPress.com at the Web 2.0 Expo, Monotone was built for photo blogs, shifting its colour palette to match each post’s image. It was a showcase for what a theme could do with a little intelligence about content.

Plugin of the Month: Gravatar

With Gravatar support built into WordPress 2.5 and identicons arriving this month, every commenter could now have a distinct image, even without signing up for an avatar. Six months after Automattic bought the service, it was becoming part of everyday WordPress.

Host of the Month: WordPress.com VIP

Thomson Reuters choosing VIP for its announcement site was another enterprise win for Automattic’s premium hosting, which was steadily building a client list of major media and corporate brands.

Looking Ahead to May 2008

May would bring WordPress’s fifth anniversary on May 27, WordCamps in Europe including Italy, and continued work on the next release, WordPress 2.6, planned for later in the summer.