WordPress News Roundup December 2012: WordPress 3.5 “Elvin” Ships a New Media Manager as Automattic Buys Code Garage

December 2012 brought the year’s second and final major release. WordPress 3.5, codenamed “Elvin” after drummer Elvin Jones, shipped on December 11 with a completely rebuilt way of uploading media and creating galleries, the new Twenty Twelve default theme and a retina-ready dashboard. The release post said more people had contributed to 3.5 than to any WordPress release before it.

Automattic ended the year with a deal and a new product. Its VaultPress team took over Code Garage, a backup and security service for WordPress sites, and WordPress.com launched an Enterprise plan to fill the gap between its Pro upgrade and full VIP hosting. A security issue in the popular W3 Total Cache plugin closed out the month.

Mergers, Acquisitions, and Investments

• Automattic acquires Code Garage (December 21): VaultPress announced that its team would take over development and maintenance of Code Garage, which offered backups, security scanning and emergency help for WordPress sites. Co-founder Peter Butler joined Automattic as part of the deal.
• Agency-friendly pricing: Mullenweg said the team hoped to learn from Code Garage’s pricing for agencies and developers who look after many client sites.

WordPress Core Updates

• WordPress 3.5 RC3 (December 4): The third release candidate included final interface improvements to the new media manager based on user feedback.
• WordPress 3.5 “Elvin” (December 11): The release reimagined how users upload photos and build galleries, a part of WordPress the announcement admitted had long been a friction point.
• Twenty Twelve as default: 3.5 made Twenty Twelve, a clean, mobile-first responsive theme, the default for new sites.
• Dashboard and plugins: The release added retina-ready graphics, a new colour picker and the ability to see and install favourite plugins from WordPress.org. The Links Manager was hidden on new installs.
• For developers: 3.5 bundled the Backbone and Underscore libraries, made switch_to_blog() much faster, allowed multisite to be installed in a subdirectory and added a new image editing API.

Other WordPress News

• WordPress.com Enterprise (December 13): Mullenweg introduced WordPress.com Enterprise, priced at about $500 a month. It offered around 90% of the benefits of VIP, which started at roughly $60,000 a year, to organisations that had outgrown the Pro plan.
• Mullenweg at LeWeb: In a twenty-minute conversation with Om Malik at LeWeb in Paris, Mullenweg discussed WordPress, Automattic and the freedom of the open web.
• bbPress review: bbPress shipped version 2.2.3 and published a review of its 2012.
• Meetings and remote work: Mullenweg wrote that Automattic had worked with essentially no meetings for seven years, relying on chat and blogs along with a few in-person meetups a year.

Security Alerts and Plugin Vulnerabilities

• W3 Total Cache database cache exposure: Around Christmas, researcher Jason A. Donenfeld reported that W3 Total Cache stored its database cache in a publicly accessible folder. On servers with directory listing enabled, attackers could browse the cache files and pull out data such as password hashes. The issue was tracked as CVE-2012-6077.
• The fix: W3 Total Cache 0.9.2.5 fixed the problem. Security firms advised site owners to update, block access to the cache folder and empty the database cache. Some, including Donenfeld, described it as partly a server configuration issue rather than purely a plugin bug.

Industry Trends and Insights

2012 ended with WordPress shipping two major releases, 3.4 and 3.5, rather than the three Mullenweg wanted. But 3.5 delivered on the promise he made in August to treat media as a first-class part of WordPress, and the new Backbone-powered media manager pointed towards a more app-like admin.

• Tiered hosting: WordPress.com Enterprise showed Automattic building a ladder of plans from free blogs to enterprise hosting, competing more directly with managed WordPress hosts.
• Consolidation in services: The Code Garage deal continued a pattern of bigger players absorbing smaller backup and security services, a market that had grown quickly after the security scares of 2011.
• Looking to ten: With WordPress turning ten in May 2013, the year closed with plenty of discussion about simplicity, blogging’s future and competition from new platforms such as Medium and the proposed Ghost.

Theme of the Month: Genesis Framework

StudioPress’s Genesis Framework remained one of the most widely used premium theme foundations at the end of 2012. As 3.5 made responsive design the default with Twenty Twelve, Genesis and its large family of child themes gave businesses a well-supported alternative for more customised sites.

Plugin of the Month: W3 Total Cache

W3 Total Cache, from Frederick Townes, was one of the most popular performance plugins in WordPress, combining page, database and object caching with CDN support. Its December security fix was a reminder to update even trusted plugins quickly, and to check how caching tools store data on the server.

Host of the Month: WordPress.com VIP

WordPress.com VIP gained a new sibling in December with the launch of WordPress.com Enterprise. Together, the two plans gave large organisations a range of options for hosting WordPress with Automattic, from managed sites to fully supported enterprise deployments.

Founder of the Month: Peter Butler

Peter Butler, co-founder of Code Garage, joined Automattic when the VaultPress team took over his company in December. During the TimThumb crisis of 2011 he had also released the free TimThumb Vulnerability Scanner plugin, helping site owners find and fix vulnerable copies of the script.

Looking Ahead to January 2013

January was expected to bring the first maintenance releases for WordPress 3.5 as users reported issues with the new media manager. Planning for WordPress 3.6 was also due to begin, and the community was looking ahead to WordPress’s tenth anniversary in May 2013.