WordPress News Roundup December 2014: WordPress 4.1 “Dinah” Ships as SoakSoak Malware Hits 100,000 Sites

December 2014 ended the year with a release and a reckoning. WordPress 4.1 “Dinah” arrived on December 18 with the elegant Twenty Fifteen theme and a calmer writing mode. Days earlier, the SoakSoak malware campaign had compromised more than 100,000 WordPress sites through the Slider Revolution vulnerability disclosed in September, the biggest security incident of the year.

The community also funded independent core work, raised the bar for themes in the directory, and kept pushing on accessibility.

Mergers, Acquisitions, and Investments

• Community-funded development: John James Jacoby’s campaign to fund work on BuddyPress, bbPress and GlotPress was fully funded by December 12, and WP Engine separately sponsored him to work on HHVM compatibility for BuddyPress.

No major acquisitions were announced in December.

WordPress Core Updates

• Release candidates: 4.1 RC1 arrived on December 11 with a target of December 16. A further release candidate followed, and RC3 on December 17 cleared the way for release the next day.
• WordPress 4.1 “Dinah”: Released on December 18 and named for jazz singer Dinah Washington, 4.1 shipped Twenty Fifteen, a blog-focused theme with broad language support from Google’s Noto fonts, and a distraction-free writing mode that fades the interface as you type. It added switching languages from General Settings, logging out of all other sessions from your profile, Vine embeds and plugin recommendations in the installer. Developers gained complex meta, date and term queries, contextual Customizer panels and theme support for title tags. John Blackbourn led the release.
• Looking to 4.2: Work began on a Menu Customizer for WordPress 4.2, continuing the push to move site management into the Customizer.

Other WordPress News

• Translation-ready themes required: From December, the WordPress.org themes directory required all themes to be translation-ready, reflecting the growth in non-English users.
• Accessibility push: The accessibility team began mobilising to make accessibility a requirement for themes in the directory.
• Jetpack 3.3: Released on December 16, Jetpack 3.3 introduced a centralised dashboard for managing multiple WordPress sites from WordPress.com.
• WordSesh 3: The third WordSesh, streamed in late December, drew about 3,000 unique viewers from 89 countries, according to its organisers.
• SIDEKICK auto-activated: GoDaddy and Media Temple drew criticism for activating the SIDEKICK walkthrough plugin on customer sites without notice.
• nRelate shuts down: The nRelate related-posts service announced it would close on December 31.
• Roots goes framework-agnostic: The Roots starter theme announced it would drop its dependence on a single CSS framework in 2015.
• Plugin discovery: ManageWP released a plugin discovery tool to help users find well-regarded plugins.
• Envato’s origins: Envato co-founder Collis Ta’eed reflected publicly on the company’s first six months.
• WordCamps keep spreading: Salvador, Brazil, announced plans for its first WordCamp, and WordCamp Maui was set for February 2015.

Security Alerts and Plugin Vulnerabilities

• SoakSoak: Over the weekend of December 13–14, Sucuri found that the SoakSoak.ru campaign had hit more than 100,000 WordPress sites, with more than 11,000 domains blacklisted by Google. The malware modified wp-includes/template-loader.php to inject JavaScript into every page. Its entry point was the Slider Revolution flaw, silently patched in February and publicised in September, which remained unpatched on many sites because the plugin was bundled with themes.
• InfiniteWP: The InfiniteWP client plugin released a security update on December 2.
• Beyond WordPress: A critical Git vulnerability was patched, and the phpBB.com site was compromised, prompting password resets for its users.

Industry Trends and Insights

• The cost of bundling: SoakSoak was the clearest proof yet that premium plugins bundled in themes, without their own update channel, put large numbers of sites at risk.
• Goodbye distorted CAPTCHAs: Google introduced its “No CAPTCHA reCAPTCHA” checkbox on December 3, and WordPress plugins adopted it quickly for login and comment forms.
• 2014 in review: The year brought three major releases (3.9, 4.0 and 4.1), Automattic’s $160 million round and a WordPress that now powered nearly a quarter of the web.

Theme of the Month: Twenty Fifteen

Twenty Fifteen, which shipped as the default theme in 4.1, was a clean, mobile-first blog theme built for readability in any language thanks to Google’s Noto fonts. After the magazine-style Twenty Fourteen, it returned the default theme to simplicity and typography.

Plugin of the Month: Nested Pages

Nested Pages offered an intuitive drag-and-drop interface for managing page hierarchies, a long-standing weak spot of the WordPress admin for content-heavy sites. It drew attention this month as a practical boost for anyone using WordPress as a CMS.

Founder of the Month: Pippin Williamson

Pippin Williamson, creator of Easy Digital Downloads, shared his approach to building a community around an open-source project this month. His mix of free core plugins and commercial extensions had become a model for sustainable WordPress businesses.

Looking Ahead to January 2015

January should bring a 4.1 maintenance release and the start of the WordPress 4.2 cycle, with the Menu Customizer a candidate feature. PressNomics 3 takes place January 22–24, and site owners will keep cleaning up after SoakSoak.