WordPress News Roundup July 2014: MailPoet Flaw Hits Thousands of Sites as WordPress 4.0 Enters Beta

July 2014 was a reminder that a single plugin bug can reach a very large number of sites. A file-upload flaw in the MailPoet newsletter plugin was exploited on a large scale within weeks of disclosure, and a similar mistake turned up in WPTouch, one of the most downloaded plugins in the directory. Meanwhile WordPress 4.0 entered beta with a new media grid, visual embed previews and a refreshed plugin installer.

Mergers, Acquisitions, and Investments

No major acquisitions or funding rounds were announced in July. VersionPress narrowly missed its crowdfunding goal at the start of the month, and WPBeginner’s fifth-anniversary campaign to fund two schools in Guatemala reached its target.

WordPress Core Updates

• WordPress 4.0 Beta 1 (July 10): Beta 1 previewed URL embeds directly in the visual editor, a new grid view for the media library with a details modal, a refreshed plugin install experience, language selection during installation, and an editor that resizes with its content while keeping toolbars pinned.
• WordPress 4.0 Beta 2 (July 18): Beta 2 refined the plugin installer and media library, updated TinyMCE with better list indentation and the return of the colour picker, tied login cookies to sessions, and included nearly 170 changes in a week.
• Customizer debate: Proposed Customizer improvements for 4.0 landed amid concerns about underlying architecture, and a new feature plugin was planned to improve image editing.
• Plugin details screen: WP Tavern previewed the new plugin details view coming in 4.0.

Other WordPress News

• Jetpack rebrands: Jetpack 3.1, released at the end of July, introduced a new logo and a custom content type for portfolios.
• Brian Richards goes full-time on WPSessions: Brian Richards left WebDevStudios to work on his WPSessions learning platform full-time.
• Kinsta’s WordPress history: Managed host Kinsta published a detailed guide to the history of WordPress and its community.
• Sidekick and WP Engine: WP Engine became the first large partner to integrate Sidekick’s interactive walkthroughs for WordPress.
• New WordCamps: The first Vietnamese WordCamp was announced for Hanoi in September, and a developer-focused WordCamp was set for Nantes, France, in November.
• Hybrid Core 2.0: Justin Tadlock’s Hybrid Core framework reached 2.0, adding Composer support.
• WordPress.tv grows internationally: WordPress.tv published its first German-language presentation and sought bilingual moderators.
• Site logos and selfies: WordPress.com moved to standardise theme support for site logos, and Automattic’s planned Gravatar app turned into a selfie app for Android.
• East Meets Press: A WordPress mini-conference, East Meets Press, was scheduled for September 17–21.
• GravityView: GravityView launched an app for displaying Gravity Forms entries on the front end of sites.
• New voices and frameworks: WPcast.fm launched as a podcast for WordPress professionals, and the object-oriented Themosis development framework entered beta.
• Charity hackathon: WordPress Cape Town announced a charity hackathon for August, building sites for local non-profits.

Security Alerts and Plugin Vulnerabilities

• MailPoet: On July 1 Sucuri disclosed a vulnerability in the MailPoet Newsletters plugin that let attackers upload files without authentication. Within weeks Sucuri estimated around 50,000 sites had been compromised, and the malware also spread to other sites on shared servers, including non-WordPress installs.
• WPTouch: On July 14 Sucuri reported a flaw in WPTouch, a mobile plugin with more than 5 million downloads. Like MailPoet, it relied on admin_init and a nonce without checking user capabilities, letting logged-in users without proper permissions upload malicious files.
• JSON REST API 1.1.1: The REST API plugin shipped a security release on July 28.

Industry Trends and Insights

• A recurring plugin mistake: MailPoet and WPTouch showed the same pattern: assuming code hooked to admin_init only ran for administrators. The lesson for developers was to check capabilities, not just nonces.
• JavaScript’s rise: Commentators predicted that much of WordPress development would soon be JavaScript-based, as the REST API and modern front-end frameworks matured.
• Page builders and design quality: Debate grew over whether visual page builders empowered users or made it too easy to build poor sites.

Plugin of the Month: Jetpack

Jetpack’s 3.1 release brought a new identity and a portfolio custom content type. The rebrand signalled Automattic’s intent to make Jetpack a recognisable product in its own right, not just a bundle of WordPress.com features.

Host of the Month: Kinsta

Kinsta, a managed WordPress host founded in 2013, raised its profile this month with a widely shared guide to WordPress’s history and community, an early example of content marketing by a newer host.

Founder of the Month: Brian Richards

Brian Richards founded WPSessions in 2013 to deliver live, expert-led WordPress training. Committing to it full-time this month reflected the growing demand for professional WordPress education.

Looking Ahead to August 2014

More WordPress 4.0 betas and a release candidate are expected in August, with the final release planned for late August or early September. WordCamp NYC takes place on August 2–3, and plugin authors will be asked to test against 4.0 and update their readme files.