WordPress News Roundup July 2015: WordPress 4.2.3 Release, WordPress 4.3 Reaches Release Candidate and Philadelphia Wins the First WordCamp US

July 2015 was a sprint towards WordPress 4.3. Four betas and a release candidate arrived in four weeks, bringing menus in the Customizer, site icons and formatting shortcuts close to launch. At the same time, the 4.2.3 security release showed how a necessary fix could still break thousands of sites when plugins relied on edge-case behaviour.

The community side of the month was dominated by one announcement: Philadelphia would host the first WordCamp US in December, replacing WordCamp San Francisco as the project’s flagship North American event.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in July. Instead, the month’s business stories were about transparency and trademarks: WP Rocket reported $355,000 in annual revenue after two years in business, and legal disputes over brand names played out between several well-known figures.

WordPress Core Updates

• WordPress 4.3 betas: Beta 1 landed on July 2, followed by Beta 2 on July 8, Beta 3 on July 15 and Beta 4 on July 22.
• Release candidate: Published on July 29 with more than 100 changes since Beta 4, targeting a final release on Tuesday, August 18.
• What 4.3 would bring: Site icons managed in the Customizer, a text editor in Press This, comments turned off on new pages by default, improved user search, and a top-level Customize link in the admin bar. PHP 4-style constructors were deprecated, prompting plugin authors to update old widget code.
• WordPress 4.2.3: Released on July 23, it fixed a cross-site scripting flaw that let Contributor and Author users compromise a site, first reported by Jon Cave and fixed by Robert Chapin of the security team, and later reported by Jouko Pynnönen. It also stopped Subscribers creating drafts through Quick Draft, an issue reported by Netanel Rubin of Check Point, and fixed 20 bugs.
• Post embeds proposed: A feature plugin proposing oEmbed support for WordPress posts appeared on July 17, the seed of the embeds feature that would ship in 4.4.
• Post formats questioned: A Trac proposal suggested removing post formats from core altogether.

Other WordPress News

• Philadelphia hosts WordCamp US: Announced on July 23, the first WordCamp US was set for December 4 to 6 in Philadelphia after a public shortlist of six cities.
• WordCamps at mid-year: A WordPress.org update reported 39 WordCamps in the first half of 2015 across 17 countries and five continents, with more than 14,000 people registered.
• Language packs for themes: WordPress.org announced theme translations and language packs, moving translation delivery from individual authors to translate.wordpress.org.
• Theme review roadmap: The Theme Review Team unanimously approved a roadmap to improve the directory and review process, and later voted to let themes use the REST API plugin.
• Thesis domain dispute: Chris Pearson lost a cybersquatting case he had brought against Automattic, and he and Matt Mullenweg then sparred publicly over patents, the GPL and trademarks.
• Lasso trademark: Nick Haskins received a cease-and-desist letter from LassoSoft over the name of his Lasso front-end editor.
• Product news: Jetpack 3.6 added the ability to manage connections, Automattic overhauled VideoPress and open-sourced technology behind it, Custom Post Type UI passed one million downloads, and PeepSo launched as a new open-source social networking plugin.
• Marketplace disruption: Envato was hit by a DDoS attack, and theme authors reported a significant drop in sales during the disruption.

Security Alerts and Plugin Vulnerabilities

• The 4.2.3 fallout: The release included Shortcode API changes made as part of the XSS fix that added new limits on some rare shortcode uses, such as shortcodes inside HTML attributes. Plugins including Types and Views were badly affected, and developers demanded more notice and a better process for security releases that change behaviour.
• Adobe Flash: Site owners and administrators were urged to update Flash immediately after a critical vulnerability emerged in early July.

Industry Trends and Insights

BuiltWith reported a 7% increase in WordPress usage between January and July 2015, more evidence of steady growth. The headwinds were real too: Stack Exchange’s blog moved from WordPress to the static site generator Jekyll, an early example of the static-site trend that would tempt developer-centric publishers.

Developer tooling was also preparing for PHP 7. PhpStorm 9 added partial PHP 7 support, and the deprecation of PHP 4-style constructors in core was a small but symbolic step in cleaning up WordPress’ codebase ahead of the new PHP generation. Meanwhile, WP Tavern began tracking who was already building with the REST API, as interest in decoupled WordPress kept rising.

Theme of the Month: Resonar

Resonar, a free blog theme from Automattic released in early July, was designed to showcase large featured images behind each post. It reflected the image-first blogging style that was popular in 2015 and was a good fit for writers who wanted a striking look without configuration.

Plugin of the Month: Custom Post Type UI

Custom Post Type UI passed one million downloads in July. By giving non-developers a simple interface for registering post types and taxonomies, it had become one of the main ways WordPress was turned from a blog into a general-purpose CMS.

Host of the Month: Flywheel

Flywheel, the Omaha-based managed host founded in 2012, continued to build its niche with designers and agencies in 2015. Its focus on a friendly dashboard and tools for managing client sites positioned it as an alternative to the more developer-centric managed hosts.

Founder of the Month: Brad Williams

Brad Williams, co-founder and CEO of WebDevStudios, saw the agency’s Custom Post Type UI plugin pass one million downloads in July. WebDevStudios had grown into one of the largest WordPress agencies in the United States, and its stewardship of widely used free plugins was part of how it gave back.

Looking Ahead to August 2015

WordPress 4.3 was scheduled for Tuesday, August 18, with Konstantin Obenland leading the release. The Prestige conference was set for August 1 and 2, and the debate over how security releases should be handled was expected to continue as the core team reflected on 4.2.3.