WordPress News Roundup August 2009: WordPress 2.8.4 Fixes a Password Reset Flaw as Gravity Forms Launches

August 2009 was another month in which security set the agenda. WordPress 2.8.3 shipped on August 3 to close privilege escalation holes missed in July, and on August 12 WordPress 2.8.4 fixed a flaw that let a crafted URL reset an administrator’s password. Neither was dramatic in isolation, but together they made upgrading feel urgent.

The commercial ecosystem had a strong month too. Rocketgenius launched Gravity Forms on August 24, the Page.ly managed hosting service opened its doors, and BuddyPress announced a simpler theme architecture for its next release.

WordPress Core Updates

• WordPress 2.8.3: Released on August 3, 2.8.3 fixed privilege escalation issues that had been overlooked in the 2.8.1 fix and were found by community members.
• WordPress 2.8.4: Released on August 12, 2.8.4 fixed a password reset vulnerability. A specially crafted URL could skip the check that confirms a reset request, causing the password of the first account without a reset key, usually the administrator, to be reset.
• 2.9 development: With the media feature vote complete, work continued on the next major version, which would bring image editing, a trash feature and easier embeds.

Other WordPress News

• Upcoming WordCamps: On August 7 WordPress.org highlighted upcoming WordCamps for developers wanting to meet others locally, and floated making WordPress.org a better tool for connecting them.
• WordCamp New York set: WordCamp NYC was scheduled for November 14–15, with organisers polling attendees on which tracks they wanted.
• New BuddyPress theme architecture: Andy Peatling announced that from version 1.1 BuddyPress would use a single theme for all pages, replacing the awkward two-theme setup required in 1.0.
• Gravatar redesign: Gravatar.com received a new look with more information and links to developer resources.
• Open source CMS awards: Nominations opened for the 2009 Open Source CMS Awards, which offered a prize pool of $24,000.
• Automattic hires: Plugin developer Stephane Daury joined Automattic as a systems wrangler.
• Commercial GPL themes: Theme developer Nathan Rice joined Modthemes, a new company selling commercial GPL themes, while iThemes publicly rebutted speculation that it was losing momentum.
• IntenseDebate update: Automattic released IntenseDebate 2.4.2, fixing a conflict that stopped the plugin from loading alongside some other plugins and scripts.

Security Alerts and Plugin Vulnerabilities

Three security releases in about five weeks gave August a clear message: older WordPress installs were becoming a liability.

• Privilege escalation (2.8.3): Areas missed in July’s plugin-permissions fix were closed after community reports. The release notes strongly recommended upgrading.
• Admin password reset (2.8.4): The reset flaw did not hand an attacker the new password, which went to the account owner by email, but it let anyone force an administrator’s password to change, which was disruptive and widely publicised.
• The warning signs: Sites that had not kept up with 2.8.x were about to face a real-world test, as a worm targeting old versions began spreading in early September.

Industry Trends and Insights

August showed a WordPress economy forming around GPL software. Gravity Forms launched as a commercial plugin sold on licences for support and updates, Page.ly offered paid managed hosting dedicated to WordPress, and theme companies increasingly positioned themselves as GPL-friendly businesses after July’s licensing guidance.

• Premium plugins arrive: Gravity Forms reported its first sale within minutes of launch, an early sign that site owners would pay for well-supported plugins.
• Managed hosting is born: Page.ly’s focus on WordPress alone anticipated a category that would grow rapidly over the next few years.
• Big publishers take notice: Mashable’s CTO, Frederick Townes, was interviewed on the Press This podcast, a sign of how seriously high-traffic publishers were now taking WordPress.

Theme of the Month: Carrington

Alex King’s Carrington was a free theme framework from Crowd Favorite built around a context-aware template system, letting developers choose templates based on categories, authors and other conditions. It offered a different model from options-heavy frameworks and was a favourite with developers building client sites in 2009.

Plugin of the Month: Gravity Forms

Gravity Forms version 1.0 went on sale on August 24 after a beta that began in June. Its visual form builder, entry management and notification tools made complex forms accessible to non-developers, and it quickly became one of the most widely used commercial plugins in the ecosystem.

Host of the Month: Page.ly

Founded by Joshua and Sally Strebel and launched in August 2009, Arizona-based Page.ly set out to combine the convenience of WordPress.com with the flexibility of self-hosted WordPress, handling updates and maintenance for customers. It is widely regarded as the first managed WordPress hosting service.

Founder of the Month: Carl Hancock

Carl Hancock, co-founder of Rocketgenius, led the launch of Gravity Forms on August 24. The plugin’s success helped prove that a sustainable business could be built on GPL-licensed WordPress plugins, a model many developers would follow.

Looking Ahead to September 2009

September was set to bring BuddyPress 1.1 with its new theme system, WordCamp Portland, and the results of the Weblog Tools Collection plugin competition. WordPress 2.9 development was expected to continue toward a beta later in the year.