WordPress News Roundup February 2008: WordPress 2.3.3 Fixes an XML-RPC Flaw as 2.5 Takes Shape

February 2008 was a month of waiting for WordPress 2.5. The redesigned release was due in March, and developers spent the month finishing it. The only release was WordPress 2.3.3 on February 5, an urgent fix for an XML-RPC flaw. Elsewhere, a major open source rival shipped a new version and Matt Mullenweg spent much of the month on interviews and panels about building WordPress and Automattic.

Mergers, Acquisitions, and Investments

No WordPress-related deals were announced. Automattic was a month removed from its Series B, and Mullenweg discussed funding and the company’s future in a video interview and on a Silicon Valley panel about building a high-growth startup quickly and cheaply.

WordPress Core Updates

• WordPress 2.3.3 (February 5): An urgent security release that fixed a flaw in the XML-RPC implementation, which could let a registered user edit posts belonging to other users on blogs with registration enabled. Several minor bugs were also fixed.
• WordPress 2.5 in development: With 2.4 skipped, work continued on 2.5 and its redesigned admin. Developers updated the code’s internal version references from 2.4 to 2.5 as the release took shape.
• 2.5 in interviews: Mullenweg discussed 2.5, scaling, bbPress and PHP in a Yahoo Developer Network interview.

Other WordPress News

• A more social WordPress.com: Mullenweg shared ideas from Rashmi Sinha on making WordPress.com feel more like a social network, a theme that would resurface within weeks when Automattic took BuddyPress under its wing.
• Libraries on WordPress: Scriblio, a library catalogue system built on WordPress, published a report on its experience working with the core project and Automattic.
• WordCamp Dallas: Mullenweg confirmed he would kick off WordCamp Dallas, set for late March.

Security Alerts and Plugin Vulnerabilities

The XML-RPC bug fixed in 2.3.3 mattered most to multi-author and community blogs that allowed open registration. On those sites, any registered user could potentially alter other people’s posts through the remote publishing interface. The team described the release as urgent and asked everyone on the 2.3 branch to upgrade.

Industry Trends and Insights

Drupal 6.0 was released on February 13, following Joomla 1.5 in January. Both rivals were positioning themselves as full content management systems, while WordPress was about to answer with a modernised admin in 2.5. The comparison would become a running theme of the next few years as more organisations used WordPress for sites that were not blogs.

Projects like Scriblio showed that shift already happening: WordPress was becoming a framework for building specialised applications, not just a blogging tool.

Plugin of the Month: Scriblio

Scriblio used WordPress to power library catalogues and digital collections. Its public account of collaborating with the core team and Automattic, which Mullenweg highlighted on February 27, offered a rare look at how outside institutions were building on WordPress.

Founder of the Month: Matt Mullenweg

Between interviews, panels and the final push on 2.5, Mullenweg spent February explaining WordPress’s open source model to developers, investors and the press, a month after securing new funding for Automattic.

Looking Ahead to March 2008

March was set to bring WordPress 2.5, its redesigned dashboard and a long list of new features, though the target date had already started to slip. WordCamp Dallas at the end of the month was the next big community event.