WordPress News Roundup December 2019: WordPress 5.3.2 Release, WordPress 5.3.1 Security Release and the First Block-Based Theme Docs

December 2019 closed the year with consolidation rather than headlines. WordPress 5.3.1 fixed four security issues and dozens of bugs on December 13, and 5.3.2 followed days later. Josepha Haden reported on the nine projects Matt Mullenweg had set for 2019, and the Gutenberg team published the first documentation describing what block-based themes might look like.

Security researchers spent the month on familiar problems, from fresh WP-VCD variants to plugins with authentication flaws, while hosts and plugin makers made moves aimed at the block editor era. Here is the month in review.

Mergers, Acquisitions, and Investments

• WPBeginner Growth Fund invests in Rymera (December 12): The fund took an equity stake in Rymera Web Co, maker of Wholesale Suite and Advanced Coupons, its first investment of round two.
• Web Ventures acquires Elegant Marketplace (December 30): InMotion Hosting’s investment arm bought Elegant Marketplace, the third-party marketplace for Divi themes and add-ons.

The most discussed commercial launch came from Bluehost, whose premium WordPress theme marketplace for customers, opened in November, drew wider attention in December.

WordPress Core Updates

• WordPress 5.3.1 (December 13): A security and maintenance release with 46 fixes and enhancements. Its four security fixes covered an unprivileged user making a post sticky through the REST API, stored XSS in crafted links, hardening of wp_kses_bad_protocol(), and stored XSS through block editor content. It also standardised admin form control heights.
• WordPress 5.3.2 (December 18): A quick follow-up with five fixes for high-severity tickets opened after 5.3.1, including a file name collision when uploading files with upper-case extensions.
• Nine projects update: Josepha Haden reported that two of 2019’s nine projects had shipped, four were targeted for WordPress 5.4 and 5.5, and three had made progress but would continue into 2020.
• Block-based themes: The Gutenberg team began documenting block-based themes, and the Theme Review Team opened a discussion on the future of themes.
• Gutenberg 7.1: Released December 11 with 161 merged pull requests, it added a welcome guide for new users, an edit and navigation mode toggle, table captions and drag-and-drop featured images.
• Block Directory prototype: The design team shared a version 1 prototype of the Block Directory in wp-admin, targeted for WordPress 5.5, while the Meta team drafted guidelines for block plugins.

Other WordPress News

• The story of the slides: WordPress.org explained how the State of the Word deck was built in the block editor with the Slides plugin.
• Gutenberg, one year on: A year after 5.0, the community took stock of the editor’s progress, with performance and usability much improved but full site editing still ahead.
• BuddyPress Beta Tester: A BuddyPress Beta Tester plugin arrived on December 2 to make testing pre-releases easier.
• Meetups pass 800: The WordPress meetup program crossed 800 groups in more than 100 countries.
• Global sponsorship: The 2020 Global Community Sponsorship Program was announced.
• Community Team reps: The Community Team began selecting its representatives for 2020.
• Customizer colour picker: At the end of the month, the Theme Review Team announced an alpha colour picker control for the Customizer, giving theme authors a standard way to offer transparency settings.
• Theme review etiquette: The Theme Review Team reminded developers not to contact reviewers outside WordPress.org systems.
• Community block sharing: The creator of EditorsKit launched a site for sharing custom block designs with the community.
• Ads in free plugins: A Black Friday banner that appeared across dashboards prompted debate about advertising inside free plugins.
• People of WordPress: The series profiled Jill Binder, who leads diverse speaker training in the community.

Security Alerts and Plugin Vulnerabilities

• Ultimate Addons authentication bypass: In mid-December, an authentication bypass was found in the Ultimate Addons for Elementor and Ultimate Addons for Beaver Builder plugins, linked to their social login features. Brainstorm Force released patched versions within hours, but attacks had already begun.
• 301 Redirects – Easy Redirect Manager: In December, Wordfence reported a critical vulnerability patched in the plugin that could allow low-privileged logged-in users to tamper with a site’s redirects.
• WP-VCD evolves: Wordfence reported in December that WP-VCD had adapted to remain the most prevalent WordPress infection it tracked.
• Core fixes: The four issues fixed in 5.3.1 were credited to Daniel Bachhuber, Simon Scannell of RIPS Technologies, the WordPress.org Security Team and Nguyen The Duc.

Industry Trends and Insights

• Themes are about to change: Early block-based theme docs signalled the biggest shift in theme development since the Customizer, with templates expressed as blocks.
• Hosts as marketplaces: Bluehost’s theme store reflected hosts’ interest in owning more of the site-building journey.
• Plugin trust: Debates about dashboard ads and the continued spread of nulled software showed how much users depend on the honesty of plugin authors and sources.
• Market share: WordPress closed 2019 powering roughly 35 percent of websites according to W3Techs, up from about a third earlier in the year.

Theme of the Month: Blocksy

Blocksy was a newer free theme built with the block editor firmly in mind, pairing fast performance with a deep set of Customizer options. It offered a glimpse of how third-party themes could embrace blocks before full site editing arrived in core.

Plugin of the Month: Rank Math

Rank Math, the SEO plugin from MyThemeShop, added block editor support in late December. Its generous free feature set had helped it grow quickly through 2019 and made it a credible challenger to long-established rivals.

Host of the Month: Bluehost

Bluehost, a long-standing WordPress.org recommended host, launched a premium theme marketplace for its customers at the end of 2019. It was one of several moves by large hosts to offer design and site-building tools alongside hosting.

Founder of the Month: Jeffrey Carandang

Jeffrey Carandang built EditorsKit, a popular toolkit that adds formatting and visibility controls to the block editor. In December he launched a community site for sharing block designs, an early bet on the kind of reusable patterns WordPress would soon embrace in core.

Looking Ahead to January 2020

January should bring planning for WordPress 5.4, due at the end of March, and further Gutenberg releases with the long-requested Buttons block. Work on XML sitemaps for core is expected to produce a feature plugin, and organisers are preparing for the first WordCamp Asia in Bangkok in February.