WordPress News Roundup February 2015: WordPress 4.1.1 Ships and Human Made Acquires Sennza

February 2015 was a month of groundwork. WordPress 4.1.1 tidied up the December release, the 4.2 cycle firmed up its feature list, and WordPress.org started showing off the redesigned directories that would define how people discovered themes and plugins for years afterwards.

Away from core, an agency acquisition hinted at consolidation among WordPress service companies, BuddyPress shipped a significant release, and two actively exploited plugin vulnerabilities kept security teams busy.

Mergers, Acquisitions, and Investments

• Human Made acquires Sennza: On February 3, UK-founded enterprise agency Human Made announced it had acquired Australian WordPress agency Sennza, which became Human Made Australia. The deal gave Human Made, then a distributed team of more than 20 people, a foothold in Australia’s enterprise market and better coverage of Asia and the US West Coast time zones.

No other notable deals were announced during the month.

WordPress Core Updates

Core shipped one maintenance release in February while the 4.2 feature set took shape.

• WordPress 4.1.1: Released on February 18, it fixed 21 bugs. The announcement noted that 4.1 had been a smooth release, downloaded more than 14 million times in its first two months.
• Theme switching in the Customizer: The Customizer theme switcher was formally proposed on February 12 and approved for merge into 4.2 on February 18, letting users preview and swap themes without leaving the live preview.
• Emoji and wider character support: Contributors confirmed that 4.2 was on track to expand core support for emoji, part of a broader move to the utf8mb4 database character set.
• Shared term splitting: With 4.2 set to split terms shared across taxonomies, a new plugin helped developers detect shared terms on their sites ahead of the change.
• New-user experience: An initiative launched to study and improve the experience of brand-new WordPress users during the 4.2 cycle.

Other WordPress News

• New Theme Directory: WordPress.org launched its redesigned Theme Directory on February 26, and the same day the Plugin Directory began showing more accurate ratings data. The Theme Review Team also updated its handbook with design recommendations and set new rules for custom CSS boxes in themes.
• BuddyPress 2.2 “Spumoni”: Released on February 4, BuddyPress 2.2 introduced a Member Type API. The 2.2.1 follow-up broke BuddyPress’ one-day download record.
• SiteGround sponsors a core contributor: Hosting company SiteGround announced it was sponsoring a full-time contributor to WordPress core, an early example of a host paying for core work directly.
• WordPress.com moves: WordPress.com added Google Analytics integration for Business plan customers only, and its new REST API-driven post editor drew attention for how much faster it felt than wp-admin. A first conference dedicated entirely to WordPress.com was also announced for March 28 in Portland, Oregon.
• Mobile: WordPress for iOS 4.8 added a visual editor on February 24.
• Developer tools: The Roots starter theme rebranded as Sage with its 8.0 release, Custom Metaboxes and Fields for WordPress (CMB2) came out of beta, and Twitter released a new official WordPress plugin built with extensibility in mind.
• Business transparency: WP Rocket shared that it had grown from nothing to $35,000 in monthly revenue, part of a wave of WordPress product companies publishing their numbers.
• HeroPress Kickstarter cancelled: Topher DeRosia’s HeroPress campaign failed to attract enough backers and was cancelled ahead of its deadline, though the project itself continued.

Security Alerts and Plugin Vulnerabilities

February’s two big security stories both involved plugins with large install bases.

• FancyBox for WordPress zero-day: A persistent cross-site scripting flaw in FancyBox for WordPress, a plugin with more than 500,000 downloads, was exploited in the wild to inject an iframe redirecting visitors to a malicious site. Sucuri confirmed active attacks, WordPress.org temporarily pulled the plugin, and the security team pushed a forced update to version 3.0.3.
• WP Slimstat SQL injection: Sucuri disclosed a high-risk flaw in the WP Slimstat analytics plugin that could allow blind SQL injection and expose data such as usernames and password hashes. Users were told to update to 3.9.6 immediately.
• Press This and copyright: Not a vulnerability, but the planned revamp of the Press This bookmarklet prompted concerns that easier clipping could encourage copyright infringement.

Industry Trends and Insights

The commercial theme market was booming. WP Tavern noted that Envato continued to earn heavily from WordPress themes sold as complete website packages, a model that pushed themes towards ever more bundled functionality. That trend sat uneasily with WordPress.org’s push to keep presentation and functionality separate, a tension that would shape theme review policy for years.

There were also signs of introspection. Writers asked whether WordPress was suffering from the innovator’s dilemma, while debates over derivative works and the GPL resurfaced as more businesses built on the platform. The speed of WordPress.com’s API-driven editor hinted at where the answer might lie: a JavaScript front end talking to WordPress through an API.

Theme of the Month: Sage

The Roots starter theme became Sage with its 8.0 release in February, bringing a modern front-end workflow with Gulp and Bower to WordPress theme development. For agencies tired of building themes the way they had in 2010, Sage showed what a contemporary toolchain could look like inside WordPress.

Plugin of the Month: CMB2

CMB2, the rewrite of the long-running Custom Metaboxes and Fields library, left beta on February 6. It gave developers a clean, well-documented way to add custom fields and meta boxes without writing the boilerplate by hand, and it became a staple of agency builds and commercial plugins alike.

Host of the Month: SiteGround

SiteGround’s decision to fund a full-time WordPress core contributor stood out in February. At a time when most sponsored core work came from Automattic and a handful of agencies, a shared and managed hosting company putting paid engineering time into core was a notable signal of how much hosts depended on WordPress.

Founder of the Month: Tom Willmot

Tom Willmot, co-founder and CEO of Human Made, led the company’s acquisition of Sennza in February. The move turned a distributed UK-born agency into one with a dedicated Australian arm, reflecting Human Made’s ambition to serve enterprise and media clients around the clock.

Looking Ahead to March 2015

March was set to bring the first WordPress 4.2 beta, after the original late-February target slipped, along with the launch of the redesigned Plugin Directory. WordCamp London was scheduled for the second half of the month, and the WordPress.com conference in Portland was set for March 28.