WordPress News Roundup April 2015: WordPress 4.2 “Powell” Ships Amid a Wave of XSS Fixes

April 2015 was one of the busiest months WordPress had seen in years. WordPress 4.2 “Powell” shipped on April 23 with a rebuilt Press This, emoji and wider character support, and faster plugin updates. It was bracketed by two critical security releases, one of them pushed out within hours of a zero-day disclosure.

Around core, the plugin ecosystem went through a coordinated security clean-up over a widely misused pair of functions, Google’s mobile ranking change arrived, and the project named the people who would lead the rest of 2015’s releases.

Mergers, Acquisitions, and Investments

• GoDaddy acquires Elto (April 10): GoDaddy bought Elto, a marketplace matching small businesses with web professionals, and folded it into its GoDaddy Pro programme.

Also worth noting was Automattic’s sponsorship of Let’s Encrypt, the free certificate authority then preparing to launch, which signalled the company’s interest in making HTTPS the default across the web.

WordPress Core Updates

• Beta 4 and the release candidate: Beta 4 arrived on April 3, and the release candidate followed on April 15 with more than 140 changes.
• WordPress 4.1.2: Released on April 21 as a critical security release. It fixed a cross-site scripting flaw that could let anonymous users compromise a site, reported by Cedric Van Bockhaven, plus three further issues, including unsafe file uploads and an SQL injection affecting some plugins.
• WordPress 4.2 “Powell”: Named after jazz pianist Bud Powell and released on April 23, 4.2 introduced a revamped Press This, native support for Chinese, Japanese and Korean characters, emoji and other symbols via the move to utf8mb4, theme switching in the Customizer, new embeds and in-place plugin updates. Led by Drew Jaynes, it had 283 contributors with props, a new record.
• WordPress 4.2.1: Released on April 27 after Jouko Pynnönen publicly disclosed a stored cross-site scripting flaw that let commenters compromise a site. The fix rolled out as an automatic background update within hours.
• New release leads: On April 6 the core team named Konstantin Obenland to lead 4.3 and Scott Taylor to lead 4.4. By the end of the month, 4.3’s focus had been set on the mobile experience, admin UI, better passwords and Customizer improvements.
• REST API v2: The first beta of version 2 of the WP REST API plugin was released on April 29, weeks after the 1.x plugin received a critical security update.

Other WordPress News

• Customizer required for theme options: From April 22, WordPress.org required theme authors to build theme options with the Customizer rather than custom settings pages, a major policy shift for free themes. Data published at the end of the month showed only 24% of directory themes supported the Customizer at that point.
• Improvements to WordPress.org: An April 4 post summarised the redesigned theme and plugin directories and other changes to the site.
• WooCommerce’s momentum: WooCommerce passed seven million downloads and was reported to be the most widely used e-commerce platform on the web.
• Give launches: WordImpress released Give, a free donations plugin for WordPress, on April 9.
• Facebook steps back: Facebook’s official WordPress plugin was found to have been abandoned.
• Other releases: Jetpack 3.5 shipped alongside 4.2, VersionPress reached 1.0, and Postmatic launched fully email-based commenting.
• Frameworks combine: The Redux and Kirki frameworks joined forces to improve Customizer support for theme developers, timely help as the new theme rules took effect.

Security Alerts and Plugin Vulnerabilities

• add_query_arg() and remove_query_arg(): Developers had widely assumed these functions escaped their output, partly because of inaccurate Codex documentation. After Joost de Valk flagged the issue, Sucuri audited several hundred popular plugins and found at least 15 with exploitable code, and Gary Pendergast of the core team helped coordinate fixes. Jetpack, WordPress SEO, All in One SEO, Gravity Forms, UpdraftPlus, Ninja Forms and others released patches together on April 20.
• WP Super Cache: A persistent cross-site scripting flaw was discovered and patched in the popular caching plugin.
• iThemes Security: iThemes patched a vulnerability affecting every version of its security plugin.
• BuddyPress 2.2.2: Addressed two potential security issues.
• Defacement warnings: The FBI warned of attackers claiming ISIL affiliation defacing WordPress sites by exploiting known plugin vulnerabilities.

Industry Trends and Insights

Google’s mobile-friendly ranking update went live on April 21, and WordPress’ long embrace of responsive themes looked prescient. The same month, Stack Overflow’s developer survey ranked WordPress as the third most dreaded technology among developers, a reminder that popularity with site owners did not always translate into affection from programmers.

The security events of the month carried a broader lesson. Automatic background updates allowed 4.1.2 and 4.2.1 to reach millions of sites quickly, while the add_query_arg() episode showed that coordinated disclosure across many vendors was possible. Matt Mullenweg also weighed in publicly on concerns about whether WordPress was secure enough for banking websites.

Theme of the Month: Toivo

Sami Keijonen’s Toivo, a bold minimalist theme for blogs and small businesses, arrived at the end of the month just as the Customizer became mandatory for WordPress.org themes. Free themes like it showed that clean design and Customizer-based options could coexist without the sprawling settings panels common in commercial themes.

Plugin of the Month: Give

Give launched on April 9 as a free, extensible donations plugin, filling a gap for non-profits that had been stitching together e-commerce plugins to accept gifts. It was also among the plugins patched in the coordinated add_query_arg() fix within weeks of launch, and it would go on to become one of the most widely used fundraising tools on WordPress.

Host of the Month: Pagely

With two core security releases and a multi-plugin patch day in a single week, April made the case for managed hosting that takes responsibility for updates. Pagely, which had been offering managed WordPress hosting since 2009, was one of the companies built on precisely that promise.

Founder of the Month: Devin Walker

Devin Walker, co-founder of WordImpress, led the launch of Give in April. Releasing a full-featured donations platform for free on WordPress.org, with paid add-ons for gateways and extras, was a bet on the freemium model that many WordPress product businesses would follow.

Looking Ahead to May 2015

May was set to bring further 4.2 maintenance work, BuddyPress 2.3 testing, WordPress’ 12th birthday on May 27, and WordCamp Miami at the end of the month. Work on 4.3, now led by Konstantin Obenland, was due to begin in earnest with feature plugins such as the Menu Customizer competing for a spot.