WordPress News Roundup December 2017: State of the Word Puts Gutenberg First as Captcha Backdoor Hits 300K Sites

December 2017 opened with WordCamp US in Nashville, where more than 1,400 people gathered for three days and Matt Mullenweg used his State of the Word to make clear that 2018 would be about Gutenberg. He announced a Classic Editor plugin for anyone not ready for the change, confirmed there would be no new default theme in 2018, and welcomed Tide into the WordPress.org project.

The month’s darker side came from security. Sucuri tracked a keylogger campaign on thousands of WordPress sites, and Wordfence revealed that the popular Captcha plugin had been backdoored after a change of ownership, pushing plugin supply chain risk to the top of the agenda.

Mergers, Acquisitions, and Investments

• WP Site Care acquires WP Radius: WordPress support company WP Site Care bought WP Radius, continuing consolidation among maintenance and care-plan providers.

The Captcha backdoor was also, in its way, an ownership story: the plugin’s original developer had announced a change of ownership in September, months before malicious code appeared.

WordPress Core Updates

No new core release shipped in December, and WordPress 4.9.1 remained current. The month’s core news came from Nashville.

• Gutenberg by the numbers: Mullenweg described Gutenberg as one of the longest-running feature projects in WordPress history, with more than 4,300 commits from over 100 contributors and weekly releases. Matías Ventura gave a live demo on stage.
• Classic Editor plugin: A Classic Editor plugin from WordPress contributors was made available for sites that wanted to keep the old editor after the switch.
• 2018 focus: The three focus areas for 2018 were Gutenberg for editing, Gutenberg for customization, and Gutenberg for themes. There would be no Twenty Eighteen theme, the first year without a new default since Twenty Ten.
• Multisite roadmap: The multisite team published its development roadmap.

Other WordPress News

• WordCamp US 2017: Held December 1–3 in Nashville with more than 1,400 attendees. Sessions were livestreamed free, and recordings went up on WordPress.tv along with the State of the Word. WordCamp US would return to Nashville in 2018, and applications to host it in 2019 and 2020 opened.
• A year of WordCamps: Mullenweg said WordCamp US was the 128th WordCamp of 2017, with around 40,000 tickets sold across the year, and that meetup attendance had risen by more than 30% after events were added to the dashboard.
• Tide joins WordPress.org: Tide, created by XWP to run automated tests on every plugin and theme in the directory, moved under the WordPress.org umbrella to be developed by the community.
• Growth Council and donations: Mullenweg said the WordPress Growth Council, with separate enterprise and consumer groups, would hold its first meeting the following week, and the WordPress Foundation began accepting direct donations.
• Survey data released: On December 22, WordPress.org published raw results from its 2015–2017 user surveys for the first time.
• WordCamp theme: The Community team discussed making the CampSite 2017 theme the default for new WordCamp sites.
• Gutenberg and the future: Morten Rand-Hendriksen’s WordCamp US talk, “Gutenberg and the WordPress of Tomorrow”, became one of the most-watched explanations of what the new editor meant.
• Storify closing: Storify announced it would shut down on May 16, 2018, and its WordPress plugin was discontinued.

Security Alerts and Plugin Vulnerabilities

• Captcha plugin backdoor: On December 19, Wordfence revealed that the Captcha plugin, installed on around 300,000 sites, contained a backdoor that could give its author, or anyone who triggered it, administrator access. The malicious code had first appeared in early December. Wordfence and the WordPress.org team pushed a clean version, 4.4.5, to affected sites, and other plugins from the same new owner were found to contain the same code.
• Keylogger campaign: Sucuri reported that about 5,500 WordPress sites had been infected with a keylogger and cryptocurrency miner loaded from a domain called cloudflare.solutions, which had no connection to Cloudflare. The script was injected through theme files and captured what visitors typed into forms. The domain was taken down on December 8.
• Jetpack 5.6.1: Jetpack shipped a security update for its contact form module.
• HackerOne results: The State of the Word reported that WordPress’s HackerOne program had resolved 52 bugs in its first months.

Industry Trends and Insights

• 29% of the web: Mullenweg said WordPress had grown by more than two percentage points in the year to power about 29% of the web.
• Supply chain risk: The Captcha case, coming after the Display Widgets case in September, made the purchase of popular plugins by unknown buyers one of the ecosystem’s most serious security issues.
• Privacy season: With GDPR enforcement due in May 2018, discussions such as WP Weekly’s conversation with Heather Burns brought privacy law to WordPress developers who had rarely thought about it.
• Content syndication: 10up’s Distributor beta and Storify’s closure showed publishers rethinking how they reuse and embed content.

Theme of the Month: CampSite 2017

CampSite 2017, first used for WordCamp Europe in Paris, was proposed in December as the default theme for new WordCamp websites. With no new core default theme coming in 2018, it was one of the few theme stories the project itself was driving, and it gave organizers a modern, flexible starting point.

Plugin of the Month: Classic Editor

The Classic Editor plugin was the reassurance many site owners needed. By promising a supported way to keep the familiar editor, the project answered one of the loudest concerns about 5.0, and as it turned out the plugin would become one of the most installed in the directory.

Host of the Month: Pressable

Pressable, the managed WordPress host in which Automattic took a majority stake in 2016, offered a direct line to the company behind WordPress.com and Jetpack at a moment when Gutenberg was being shaped largely by Automattic contributors. For site owners wanting managed hosting close to the project’s direction, it was a natural option.

Founder of the Month: Mark Maunder

Mark Maunder, founder and CEO of Wordfence, led the team that uncovered the Captcha backdoor and helped push a clean version to hundreds of thousands of sites. Wordfence’s work in December showed how much the ecosystem relied on independent researchers to catch threats in the plugin directory.

Looking Ahead to January 2018

January was expected to bring the next WordPress 4.9 maintenance release and Gutenberg 2.0. WordCamp Albuquerque was set for its fifth edition, and WPCampus Online, a free virtual conference on WordPress in higher education, was scheduled for January 30.

Annual surveys for meetup members and organizers were open, and the Community team was gathering suggestions for its 2018 goals.