WordPress News Roundup April 2020: WordPress 5.4.1 Security Release as WordCamp Europe and WordCamp US Go Online

April 2020 was the month the WordPress community accepted that its biggest gatherings would happen online. WordCamp Europe announced a free virtual event for June, and at the end of the month WordCamp US said it would also go online. Meanwhile, contributors kept shipping: WordPress 5.4.1 fixed seven security issues on April 29, and Gutenberg 8.0 merged the block and pattern inserters.

It was also a month of small but telling stories about how WordPress adapted to lockdown, from a free plugin for contact-free deliveries to a burst of online meetups and summits. Here is what happened.

Mergers, Acquisitions, and Investments

• Watchful acquires XCloner (April 3): The site management platform took over XCloner, a decade-old backup plugin with more than 40,000 users.
• Frontity raises €1 million (April 22): Frontity, the React framework for building headless WordPress front ends, raised €1 million from Automattic and K Fund.
• Kirki finds a new owner: David Vongries took over ownership of the Kirki Customizer Framework, a toolkit used by many themes.

WordPress Core Updates

• WordPress 5.4.1 (April 29): A security and maintenance release with 17 bug fixes and seven security fixes, preceded by an RC on April 24. Security fixes covered password reset tokens that were not properly invalidated, certain private posts being viewable without logging in, and several XSS issues in the Customizer, the search block, wp-object-cache and file uploads. All versions back to 3.7 received the fixes.
• WordPress 5.5 kicks off: The release cycle began with a call for tickets on April 8.
• Gutenberg 7.9 (April 15): Added gradients to more blocks, extra typography controls, three new patterns and improved block markup.
• Gutenberg 8.0 (April 29): Merged the block and pattern inserters, added more inline formatting options and updated the code editor.
• Consent API proposal: Contributors proposed a Consent API feature plugin to standardise how plugins handle cookie consent.
• Dashicons retired: The Dashicons project announced it would stop development in favour of a new icon component in the block editor.

Other WordPress News

• WordCamp Europe goes virtual: On April 6, organisers announced WordCamp Europe 2020 Online for June 4–6, with free tickets, a virtual contributor day and two half days of talks and workshops. Registration opened on April 27.
• WordCamp US goes online: On April 30, WordCamp US announced that its October 27–29 event would take place online and be free to attend.
• BuddyPress 6.0 betas: BuddyPress 6.0 introduced Group and Member blocks in beta and reached release candidate on April 29, ahead of a mid-May release.
• Theme review on GitHub: The Theme Review Team proposed moving theme reviews to GitHub.
• Jetpack Search relaunched: Jetpack relaunched its search feature as a standalone paid service.
• WPBlockTalk: Sessions from the online WPBlockTalk event were published on WordPress.tv.
• Meetups under lockdown: Meetup organisers experimented with online formats as in-person events remained on hold.
• Quarterly updates: Contributor teams posted their Q1 2020 updates.
• People of WordPress: The series profiled Mario Peshev from Bulgaria.

Security Alerts and Plugin Vulnerabilities

• WordPress 5.4.1: Wordfence published a detailed breakdown of the seven vulnerabilities fixed in core on April 30, urging prompt updates.
• Ninja Forms: A high-severity cross-site request forgery flaw that could lead to stored XSS was patched on April 29.
• LearnPress: High-severity vulnerabilities were fixed in the LearnPress LMS plugin, important for the many schools moving teaching online.
• MapPress Maps: Critical flaws patched in MapPress could allow remote code execution by authenticated users.
• Real-Time Find and Replace: A high-severity CSRF vulnerability was fixed on April 27.
• Widget Settings Importer/Exporter: Wordfence disclosed an unpatched high-severity flaw on April 15 and advised removing the plugin.

Industry Trends and Insights

• Online everything: With conferences, classes and shops moving online, WordPress became infrastructure for a sudden digital shift, and event plugins and ecommerce tools saw new demand.
• Free shopping listings: Google opened Google Shopping to free product listings in the US on April 21, a boost for WooCommerce store owners.
• Headless gathers momentum: Automattic’s investment in Frontity suggested the company saw a future for decoupled WordPress alongside the traditional stack.
• Privacy by design: The Consent API proposal reflected pressure from privacy laws for a consistent way to handle tracking consent.
• Free tools for teams: GitHub made its core features free for teams of any size in mid-April, including unlimited collaborators on private repositories, lowering costs for small WordPress agencies.
• Virtual summits multiply: With conferences cancelled, free online summits for WordPress professionals sprang up, such as the WP Feedback summit that began on April 27.

Theme of the Month: Hello Elementor

Hello Elementor is a deliberately minimal theme that leaves layout and design to the Elementor page builder. As many small businesses rushed to build or rework sites during lockdown, a fast, unopinionated base was a popular choice.

Plugin of the Month: Leave at Door

Leave at Door, a free WooCommerce plugin released in April, let customers request contact-free delivery and leave delivery instructions at checkout. It was a small, practical response to a pandemic that changed how local shops and restaurants operated.

Host of the Month: WP Engine

WP Engine’s managed platform, which now included Flywheel and the Genesis Framework, served a wide range of businesses from freelancers to enterprises. As traffic patterns shifted under lockdown, managed hosting with caching and support built in was in demand.

Founder of the Month: Pablo Postigo

Pablo Postigo co-founded Frontity, which aims to make it easier to build fast React front ends for WordPress sites. April’s €1 million round, backed by Automattic, brought new attention to headless WordPress as a mainstream option.

Looking Ahead to May 2020

May should bring BuddyPress 6.0, more Gutenberg releases focused on patterns, and planning decisions about which editor features make WordPress 5.5. WordCamp Spain will run online in early May, and WordPress turns 17 on May 27. WordCamp Europe’s online event follows in early June.

Contributors will also begin deciding which of the planned editor features, from block patterns to new navigation and widget screens, are ready to target WordPress 5.5 in August.