WordPress News Roundup April 2018: WordPress 4.9.5 Ships and Core Calls for GDPR Tool Testers

April 2018 was a month of preparation for a very big May. WordPress 4.9.5 shipped on April 3 with three security fixes and 25 bug fixes, the GDPR Compliance team asked for volunteers to test the privacy tools heading into core, and the project invited communities worldwide to celebrate WordPress’s 15th anniversary on May 27.

Gutenberg also took visible steps forward, adding drag-and-drop block sorting and permalink editing, while a new migration guide began collecting what plugin developers needed to know. The Theme Review team changed its process to tackle long review delays, and the Plugin Directory made clear that hosted plugins could not promise legal compliance.

Mergers, Acquisitions, and Investments

No major WordPress acquisitions or funding rounds were announced in April. Product companies were focused on readiness rather than deals, with GDPR updates and Gutenberg compatibility work taking priority across the plugin market.

WordPress Core Updates

• WordPress 4.9.5: Released April 3 as a security and maintenance release for all versions since 3.7. Alongside three security fixes, it fixed 25 bugs, including restoring caption shortcode styling, enabling image cropping on touch screens, clarifying error messages, making nonce handling consistent in the REST API JavaScript client and improving PHP 7.2 compatibility.
• Try Gutenberg held back: The planned dashboard prompt inviting users to try Gutenberg was pulled before 4.9.5 shipped so contributors could resolve some important issues first. It would eventually arrive in 4.9.8 in the summer.
• Release lessons: The two 4.9.5 release leads shared feedback on what it was like to lead a minor release.
• GDPR tools: On April 12, the project called for volunteers to test privacy tools under development in core, including data export and erasure features.
• Gutenberg 2.6 and 2.7: Gutenberg 2.6 introduced drag-and-drop block sorting, and 2.7 added the ability to edit permalinks in the new editor.
• Migration guide: Daniel Bachhuber started a Gutenberg migration guide to help plugin developers adapt their code, with contributions collected on GitHub.

Other WordPress News

• WordPress turns 15: On April 20, the project invited fans everywhere to host parties for the 15th anniversary of the first WordPress release on May 27, with events listed on a central site.
• Theme review changes: The Theme Review team changed its process to cut delays, placing more responsibility on theme authors, and at the end of the month announced a Trusted Authors program for reliable, frequent submitters.
• Plugins and legal compliance: WordPress.org updated its guidelines so plugins in the directory could no longer claim to guarantee legal compliance, an important clarification as GDPR plugins multiplied.
• A WordCamp for organizers: Planning began for a WordCamp aimed specifically at event organizers.
• About pages redesigned: WordPress.org’s About pages received a significant redesign.
• Incubator roadmap: The Community team posted its 2018–2019 roadmap for the WordCamp Incubator.
• Accessibility and marketing: The Accessibility team sought contributors for its handbook, and the Marketing team created an onboarding PDF for Contributor Days.
• BuddyPress 3.0 betas: BuddyPress 3.0 reached its second beta, with a new template pack in the works.
• Mobile friction: Testers found that the WordPress for iOS app and Gutenberg did not work well together yet, a gap the mobile team would need to close.

Security Alerts and Plugin Vulnerabilities

• WordPress 4.9.5 security fixes: Core stopped treating localhost as the same host by default, used safe redirects on the login page when SSL was forced, and properly escaped the version string in generator tags. The issues were reported by xknown and Garth Mortensen of the WordPress security team and by Nitin Venkatesh.
• Drupalgeddon fallout: Attacks on Drupal sites that had not patched March’s critical flaw spread through April, and a second critical Drupal fix followed late in the month. Mixed WordPress and Drupal hosts had a busy month.
• Privacy as security: The GDPR testing call framed data export and erasure as part of keeping user data safe, not just a legal requirement.

Industry Trends and Insights

• The GDPR rush: With the May 25 deadline weeks away, agencies and plugin developers scrambled to add consent tools, data export and updated privacy policies, and WooCommerce discussed its own GDPR plans.
• Gutenberg becomes concrete: Features like drag and drop and permalink editing, plus a migration guide, made Gutenberg feel less like an experiment and more like the next editor.
• AMP progress: The AMP for WordPress plugin reached a 0.7 release candidate, reflecting the continuing collaboration between Automattic, Google and XWP.
• Building products: Delicious Brains shared how it creates and releases its WordPress plugins, offering a rare inside view of a successful product company.

Theme of the Month: Avada

Avada, ThemeForest’s long-standing best-selling theme, had one of the biggest user bases of any commercial WordPress theme. As the Theme Review team reworked its process and Gutenberg neared, Avada’s customers were a reminder of how many sites relied on premium themes and builders that would need careful updates for the new editor.

Plugin of the Month: BuddyPress

BuddyPress 3.0 reached its second beta in April, one of the most significant updates to WordPress’s community plugin in years. For membership sites, schools and social networks built on WordPress, it promised a more modern foundation.

Host of the Month: Flywheel

Flywheel’s managed hosting and its free Local app were popular with designers and agencies. With GDPR tools and Gutenberg both in testing, a quick local environment for trying betas safely was exactly what many teams needed in April.

Founder of the Month: Brad Touesnard

Brad Touesnard, founder of Delicious Brains, saw his company’s approach to building and shipping plugins featured in April. The team behind WP Migrate DB Pro and WP Offload S3 had become a model for a small, remote WordPress product business that put developer experience first.

Looking Ahead to May 2018

May would be one of the biggest months of the year. A 4.9.x release with privacy tools was expected ahead of GDPR enforcement on May 25, and WordPress’s 15th anniversary on May 27 would be celebrated with parties around the world.

Gutenberg releases were set to continue, and WordCamp Europe in Belgrade, scheduled for June 14–16, was drawing closer.