WordPress News Roundup February 2017: REST API Flaw Fuels Mass Defacements as Gutenberg Prototype Debuts

February 2017 was the month the WordPress community learned why automatic updates matter. On February 1, the security team disclosed the REST API privilege escalation it had quietly fixed in WordPress 4.7.2, and within a day attackers were defacing sites that had not updated. Defacement campaigns ran for weeks, with tens of thousands of hacked pages appearing in search results.

The month also brought a glimpse of the future. The core editor team published a UI prototype of a block-based editor called “Gutenberg”, the first public look at the project that would reshape WordPress over the next two years.

Mergers, Acquisitions, and Investments

No significant WordPress acquisitions or funding rounds were announced in February. Product news came instead from launches, such as 10up’s ElasticPress.io, a hosted Elasticsearch service for WordPress sites, and Freemius extending its analytics platform to theme developers.

WordPress Core Updates

There was no new core release in February, but the month was dominated by core news.

• The 4.7.2 disclosure: On February 1, Aaron D. Campbell explained the extra fix shipped in 4.7.2: an unauthenticated privilege escalation in the REST API affecting WordPress 4.7 and 4.7.1, reported by Sucuri on January 20. The week-long delay had given automatic updates time to protect millions of sites before details were public.
• Gutenberg prototype: The editor focus team, led by Matías Ventura and Joen Asmussen, published a UI prototype of a block-based editor named after the inventor of the printing press. It was rough and experimental, but the idea of treating every piece of content as a block was now on the table.
• Signed updates: After a widely shared critique of WordPress’s update security, Matt Mullenweg responded that digital signatures for updates were important but not an immediate priority. The debate would come back regularly over the following years.
• WP-CLI 1.1.0: The newly official command-line project shipped its first release of the year and shifted its focus toward expanding the package index.

Other WordPress News

• Community Summit dates: The 2017 WordPress Community Summit was set for June 13–14 in Paris, just before WordCamp Europe.
• Zerif Lite returns: ThemeIsle’s Zerif Lite was reinstated in the WordPress.org theme directory after a five-month suspension, with its developers reporting a 63% drop in revenue during the absence.
• Disappearing plugins: A wave of plugins vanishing from the directory prompted explanations of how and why the Plugin Review team closes listings, usually for security or guideline issues.
• Disqus ads: Disqus began showing unwanted ads on some sites and announced plans to charge large publishers a monthly fee to remove them, pushing some WordPress users back toward native comments.
• BuddyPress 2.8: The release raised its minimum PHP requirement and added a companion stylesheet for Twenty Seventeen.
• Education: OSTraining partnered with GoDaddy to publish a free beginner WordPress course on YouTube, and WordCamp Miami announced a JavaScript track and a two-day kids’ camp for its March event.

Security Alerts and Plugin Vulnerabilities

February was one of the busiest security months WordPress had seen.

• REST API defacements: Sucuri reported exploit attempts in the wild less than 24 hours after disclosure. By February 6 it was tracking four defacement groups, with one campaign alone accounting for more than 68,000 indexed pages. Only sites still on 4.7 or 4.7.1 were vulnerable, which meant most victims had automatic updates disabled.
• Exploits continue: Attacks carried on through mid-February, keeping pressure on anyone still running an unpatched site. Google Search Console also sent confusing notices to site owners about updating WordPress, which it later corrected.
• WP Super Cache 1.4.9: The popular caching plugin patched multiple cross-site scripting vulnerabilities early in the month.
• BlogVault breach: The backup service suffered a security breach that injected malware into some customer sites, an uncomfortable reminder that third-party services with site access are also targets.
• NextGEN Gallery: At the end of the month, NextGEN Gallery patched a critical SQL injection vulnerability, and users were urged to update right away.
• Cloudbleed: On February 23, a Cloudflare memory leak was found to have exposed private data from sites using its proxy, prompting many WordPress site owners behind the service to rotate passwords and sessions.

Industry Trends and Insights

• Encryption tipping point: More than half of web traffic was now encrypted, according to figures reported early in the month.
• Cloud fragility: The Amazon S3 outage on February 28 disrupted services and support for a number of WordPress businesses that relied on AWS for storage, backups and CDN delivery.
• Bug bounties for open source: HackerOne launched a free community edition for non-commercial open source projects, a step toward WordPress joining the platform a few months later.
• AMP changes: Google updated AMP so that the canonical URL could be shared, easing one of publishers’ main complaints about the format.

Theme of the Month: Zerif Lite

Zerif Lite’s return to WordPress.org was February’s most-discussed theme story. One of the directory’s most popular one-page business themes, it had been removed in a dispute over guideline compliance, and its reinstatement, along with the revenue figures shared by ThemeIsle, showed how much a commercial theme business could depend on the free directory.

Plugin of the Month: Wordfence Security

With defacement groups scanning the web for unpatched REST API endpoints, February was a month when firewall and scanning plugins earned their keep. Wordfence Security, already installed on well over a million sites, gave site owners a way to block known attack patterns and detect changed files while they caught up on updates.

Host of the Month: Pagely

The 4.7.2 disclosure showed how important hosts had become to WordPress security, since the security team briefed hosts privately so they could add protections before details went public. Pagely, one of the original managed WordPress hosts, represented the kind of hands-on, update-first hosting that kept customer sites out of the defacement statistics.

Founder of the Month: Daniel Cid

Daniel Cid, Sucuri’s founder and CTO, was at the center of February’s biggest story. His team’s researcher found the REST API flaw, Sucuri helped the WordPress security team coordinate firewall protections, and its research tracked the defacement campaigns once the details were public.

Looking Ahead to March 2017

March was expected to bring the next maintenance and security release for the 4.7 branch, along with more feedback on the Gutenberg prototype. The Plugin Directory redesign, in testing for months, was also close to launch.

On the community calendar, WordCamp Miami was set for late March, and WooCommerce was preparing its long-awaited next major release.