WordPress News Roundup January 2017: WordPress 4.7.1 and 4.7.2 Patch Core as Focus Leads Take Charge

January 2017 opened the year with WordPress 4.7 “Vaughan” barely a month old and already running on a huge slice of the web. The month was defined by two security releases in quick succession, WordPress 4.7.1 and 4.7.2, and by Matt Mullenweg’s move to a focus-based development model, with named leads for the editor, the Customizer and the REST API.

Behind the scenes, January also contained one of the most carefully managed security fixes in the project’s history. A serious REST API flaw was patched quietly in 4.7.2 while hosts and firewall vendors put protections in place, a decision that would dominate the conversation in February.

Mergers, Acquisitions, and Investments

No major WordPress acquisitions or funding rounds were announced in January. The closest thing to an investment story was Manton Reece’s Micro.blog Kickstarter, which passed its funding goal early in the month and climbed past $65,000 by late January, with DreamHost signing on as a backer of the independent microblogging project.

WordPress Core Updates

Core shipped two point releases for the 4.7 branch, and the leadership structure for the year took shape.

• Focus leads named: On January 4, Matt Mullenweg announced the tech and design leads for 2017’s three focus areas: Matías Ventura and Joen Asmussen for the editor, Weston Ruter and Mel Choyce for the Customizer, and Ryan McCue and K. Adam White for the REST API. Core also moved from time-based to project-based releases, shipping major versions when meaningful user-facing improvements were ready.
• WordPress 4.7.1: Released January 11, it fixed eight security issues and 62 bugs. The security fixes included a precautionary PHPMailer update, a REST API change that stopped exposing user data for post types that had not opted in, and fixes for several XSS and CSRF issues. WordPress 4.7 had passed 10 million downloads by then.
• WordPress 4.7.2: Released January 26, it publicly listed three fixes: a Press This permissions issue, hardening of WP_Query against SQL injection introduced by plugins and themes, and an XSS bug in the posts list table. The release notes hinted at an additional fix whose disclosure was being held back.
• WP-CLI goes official: The command-line tool for managing WordPress became an official WordPress.org project at the start of the month, with its own team and a place in the Make network.

Other WordPress News

• A new security czar: Aaron D. Campbell replaced Nikolay Bachiyski as the lead of the WordPress security team in mid-January, taking over just in time for one of the most delicate disclosures the team had handled.
• WooCommerce.com and WordPress.com accounts: At the end of the month, logging in to WooCommerce.com began requiring a WordPress.com account, tying Automattic’s commerce business more closely to its wider account system.
• Jetpack 4.5: Jetpack brought WordAds into the plugin, giving self-hosted sites on paid plans a route to Automattic’s ad network.
• Telemetry and privacy: A proposal to collect anonymous usage data from WordPress installs reopened an old debate about privacy, with the EU’s General Data Protection Regulation already on the horizon for 2018.
• Wix and the GPL: Wix removed GPL-licensed WordPress code from its mobile app after the licensing issue was raised publicly, and switched to a fork of the original MIT-licensed library.
• WordCamp Europe 2017: Organizers of the Paris event announced they would experiment with sponsor workshops, one of several format tests ahead of the June conference.
• Community growth: The incubator WordCamp in Denpasar, Bali, was reported as a success, a sign that the program for first-time WordCamp cities was working.

Security Alerts and Plugin Vulnerabilities

January’s security story was almost entirely about core. The 4.7.1 release dealt with a long list of issues reported by researchers including Dawid Golunski and Paul Buonopane (PHPMailer), Krogsgard and Chris Jean (REST API user data), and members of the WordPress security team.

The bigger story was hidden in 4.7.2. Sucuri researcher Marc-Alexandre Montpas had reported an unauthenticated privilege escalation in the REST API content endpoints on January 20. Rather than announce it, the security team shipped the fix silently through automatic updates on January 26, after working with Sucuri, SiteLock, Cloudflare, Incapsula and a number of hosts to block exploit attempts. As we now know, the full disclosure on February 1 would be followed within a day by mass defacement campaigns against sites that had not updated.

Industry Trends and Insights

• Fastest-growing CMS: W3Techs named WordPress the fastest-growing content management system of 2016, extending its lead over Joomla and Drupal.
• HTTPS everywhere: Let’s Encrypt reported more than 20 million active certificates by the end of 2016, and SiteGround started issuing them automatically for new domains, a sign that free TLS was becoming a hosting default.
• The open web: Micro.blog’s Kickstarter success showed real appetite for independent publishing outside the big social networks, a theme WordPress itself leaned on in its own marketing.
• High-profile sites: The Obama Foundation launched its new site on WordPress, one of several large organizations using the platform for major launches.

Theme of the Month: Twenty Seventeen

Twenty Seventeen shipped with WordPress 4.7 in December and was the default theme on every fresh install in January. Built for business sites rather than blogs, it introduced a large header image or video, front-page sections and starter content, and it gave the Customizer team a showcase for what a modern default theme could do.

Plugin of the Month: Jetpack

Jetpack 4.5 added WordAds integration for paid plans, giving self-hosted publishers a way to earn from the same ad program that ran on WordPress.com. Combined with the new requirement for WordPress.com accounts on WooCommerce.com, it showed how central Jetpack had become to Automattic’s strategy for linking the self-hosted and hosted worlds.

Host of the Month: SiteGround

SiteGround began automatically issuing Let’s Encrypt certificates for new domains in January, removing a manual step that kept many small sites on plain HTTP. With browsers preparing to flag insecure pages more aggressively, it was a practical move that put the host ahead of many competitors.

Founder of the Month: Manton Reece

Manton Reece’s Micro.blog Kickstarter beat its goal in the first days of January and kept climbing through the month. His pitch, that people should own their short posts on their own domains, sat comfortably alongside WordPress’s open web message, and it gave independent blogging some welcome momentum.

Looking Ahead to February 2017

February would start with the disclosure of the extra REST API fix in 4.7.2, and site owners who had disabled automatic updates would be the ones at risk. Work on the new editor was also about to become public, with the editor team preparing an early prototype of a block-based interface.

The Community team was preparing for a busy spring of WordCamps, including WordCamp Miami in March, while planning continued for June’s Community Summit and WordCamp Europe in Paris.