WordPress News Roundup February 2020: WordCamp Asia Cancelled as WordPress 5.4 Enters Beta

February 2020 was the month the pandemic first reached the WordPress community. On February 12, organisers cancelled the inaugural WordCamp Asia in Bangkok, days before it was due to begin, because of concern and uncertainty around COVID-19. It was the first of many events that would be lost in 2020, and the community responded with an impromptu livestream instead.

Core development carried on regardless. WordPress 5.4 entered beta, automatic plugin and theme updates were slated for 5.5, and the commercial ecosystem saw two significant deals. Security researchers, meanwhile, tracked a run of attacks on recently patched and unpatched plugins.

Mergers, Acquisitions, and Investments

• Awesome Motive acquires All in One SEO Pack (February 6): Syed Balkhi’s company bought one of WordPress’s oldest SEO plugins, adding it to a portfolio that included WPForms, MonsterInsights and OptinMonster.
• Elementor raises $15 million (February 26): The page builder company announced its first major funding round and said it would invest in its team, product and community.
• Web Ventures buys weForms and Sprout Invoices (February 28–29): At WordCamp Miami, InMotion Hosting’s investment arm bought weForms, weDevs’ form builder, and then Sprout Invoices, Dan Cameron’s invoicing plugin.
• WooCommerce and Square: WooCommerce partnered with Square to expand payment services for CBD merchants in the US.

WordPress Core Updates

• WordPress 5.4 Beta 1, 2 and 3: Beta 1 arrived on February 11, Beta 2 on February 18 and Beta 3 on February 25. The release would merge ten Gutenberg plugin releases into core, including new Social Icons and Buttons blocks, and was scheduled for March 31.
• Auto-updates for 5.5: Opt-in automatic updates for plugins and themes, one of 2019’s nine projects, were slated for WordPress 5.5 through a feature plugin.
• Gutenberg 7.4, 7.5 and 7.6: Version 7.4 added background colours to Columns and text colours to Group, 7.5 followed on February 12, and 7.6 promoted Social Links to a stable block and added more blocks for full site editing.
• Trac meets GitHub: An experimental feature let contributors link GitHub pull requests to Trac tickets.
• create-block package: The Gutenberg team released @wordpress/create-block for scaffolding new blocks.
• Sitemaps meetings: The core XML sitemaps project held its first meeting on February 25.

Other WordPress News

• WordCamp Asia cancelled: The cancellation was announced on February 12. Organisers worked on refunds and began planning WordCamp Asia 2021, and a pop-up livestream on February 22 gave some speakers a chance to present.
• More postponements: WordCamp Retreat Soltau and WordCamp Genève were also postponed because of COVID-19.
• Featured themes paused: The Theme Directory’s featured themes list was removed for now while the Theme Review Team reconsidered how to curate it.
• Future of themes: The first biweekly block-based themes meeting on February 5 focused on how themes and full site editing would fit together.
• WordCamp Centroamérica: The first regional WordCamp for Central America, planned for Managua in September, opened calls for speakers and sponsors.
• WordPress Foundation donations: The Foundation published details of its 2019 charitable donations, including to Black Girls Code and the Internet Archive.
• Flywheel after the acquisition: Flywheel shared how its first months as part of WP Engine had gone.
• People of WordPress: The series profiled Kori Ashton.

Security Alerts and Plugin Vulnerabilities

• ThemeGrill Demo Importer: In mid-February, a critical flaw in ThemeGrill Demo Importer could let unauthenticated attackers wipe a site’s database, and log in as administrator if a user named “admin” existed. It was actively exploited, and ThemeGrill shipped fixes on February 16 and 18.
• Duplicator attacks: On February 20, Wordfence warned of active attacks on a recently patched arbitrary file download flaw in Duplicator, a plugin installed on over a million sites, which could expose database credentials.
• ThemeREX Addons zero-day: An unpatched flaw in ThemeREX Addons, bundled with many commercial themes, was exploited in the wild to create administrator accounts.
• Zero-day campaign: On February 27, Wordfence described a site takeover campaign exploiting several zero-day vulnerabilities in different plugins at once.
• Other fixes: Vulnerabilities were also patched in wpCentral, which allowed privilege escalation, and in Pricing Table by Supsystic.

Industry Trends and Insights

• Events under threat: WordCamp Asia’s cancellation was the first sign that in-person community events, central to WordPress culture, would be disrupted for a long time.
• Consolidation continues: Awesome Motive’s purchase of All in One SEO Pack showed established plugins still had strong commercial value, especially when added to a larger portfolio.
• Page builders attract capital: Elementor’s funding round confirmed that page builders were thriving alongside the block editor, not disappearing because of it.
• Auto-updates and security: A month of mass exploitation of patched plugins made the case for automatic plugin updates in core especially clear.

Theme of the Month: Neve

ThemeIsle’s Neve was a lightweight, mobile-first multipurpose theme with starter sites and support for both the block editor and popular page builders. It suited small businesses that wanted speed without giving up flexibility.

Plugin of the Month: All in One SEO Pack

All in One SEO Pack had been helping WordPress sites with titles, meta descriptions and sitemaps for well over a decade. Its sale to Awesome Motive in February signalled a new phase of investment for one of the plugin directory’s most installed tools.

Host of the Month: Flywheel

Flywheel continued to focus on designers and creative agencies after joining WP Engine, keeping its own brand, dashboard and Local development app. Its update on life after the acquisition offered rare transparency about how such deals play out.

Founder of the Month: Yoni Luksenberg

Yoni Luksenberg co-founded Elementor and led it as CEO. February’s $15 million funding round capped a remarkable rise for a page builder that had launched only a few years earlier and had become one of the most popular plugins in the ecosystem.

Looking Ahead to March 2020

March should bring the WordPress 5.4 release candidates and the final release, scheduled for March 31. Gutenberg is expected to introduce a first version of block patterns. With COVID-19 spreading, more WordCamps and meetups may be postponed, and the Community Team is preparing guidance for organisers.