WordPress News Roundup December 2007: Urgent WordPress 2.3.2 Fix as Movable Type Goes Open Source

December 2007 was meant to be the month of WordPress 2.4. Instead it ended with an urgent security update, WordPress 2.3.2, released on December 29, while the bigger release slipped quietly into the new year. The wider blogging market had its own headline: Six Apart released Movable Type as open source software, putting WordPress’s oldest rival on the same licensing footing.

Mergers, Acquisitions, and Investments

No WordPress-related acquisitions or investments were announced in December.

WordPress Core Updates

• WordPress 2.3.2 (December 29): An urgent security release that fixed a bug which could expose draft posts, hid error messages that revealed database table structure, and closed information leaks in the XML-RPC and Atom Publishing Protocol implementations.
• WordPress 2.4 slips: The release planned for December did not ship. The large admin changes begun in late October were not ready, and in early January the team would confirm a new plan.

Other WordPress News

• Yahoo builds for WordPress: Yahoo released its Shortcuts service as a WordPress plugin, which Matt Mullenweg highlighted on December 13.
• WordPress versus homegrown systems: Mullenweg linked to a ZDNet piece comparing WordPress with custom-built content management systems, and to a developer who praised WordPress as “infinitely extensible”.
• Dating web services: In “Web Apps with Class”, Mullenweg proposed describing services by their launch year, using WordPress.org, WordPress.com, Akismet and bbPress as examples.
• Feeds in search: He also noted that WordPress feeds had been showing up in web search results, and that Google had stopped including them.
• Merchandise: The WordPress store added a WordPress hoodie for the northern winter.
• On the radio: Mullenweg appeared on Blog Talk Radio early in the month to talk about WordPress.

Security Alerts and Plugin Vulnerabilities

WordPress 2.3.2 was the month’s key security event. The draft exposure bug meant unpublished posts could be seen by people who should not have access to them, a serious problem for anyone using drafts to prepare sensitive announcements. The release also tightened what WordPress revealed in error messages and through its remote publishing interfaces. Administrators were urged to upgrade straight away, even over the holiday period.

Industry Trends and Insights

On December 12, Six Apart announced Movable Type Open Source, a GPL-licensed edition based on Movable Type 4. Movable Type had been the dominant self-hosted blogging tool when WordPress started, and its 2004 licensing change had pushed many bloggers toward WordPress. Going open source removed that difference, though by now WordPress’s community and plugin ecosystem had a large head start.

Large companies building WordPress plugins, as Yahoo did this month, showed a related shift: WordPress was becoming a platform others wanted to integrate with, not just a tool for individual bloggers.

Plugin of the Month: Yahoo! Shortcuts

Yahoo’s Shortcuts plugin brought the company’s contextual linking service to self-hosted WordPress blogs. Whatever its long-term fate, a plugin from one of the web’s biggest companies was a notable vote of confidence in WordPress.

Founder of the Month: Matt Mullenweg

Mullenweg closed out 2007 having met the goal he set at the start of the year: 2.1, 2.2 and 2.3 had all shipped, the three major releases he had promised.

Looking Ahead to January 2008

The first question for January was when the next major release would arrive and what it would be called. Users also needed to roll out 2.3.2, which had arrived only days before the new year.