WordPress News Roundup July 2016: WordPress 4.6 Reaches Release Candidate as Summer of Pwnage Hits Plugins

July 2016 was a busy month for WordPress security researchers. Summer of Pwnage, a Dutch community programme hosted by security firm Securify, turned its attention to WordPress plugins and turned up dozens of vulnerabilities, including issues in Ninja Forms and WooCommerce. At the same time, WordPress 4.6 moved through three betas and a release candidate on its way to an August launch.

The month also marked the end of a brand. WooThemes.com was redirected to WooCommerce.com, confirming that, a year after the Automattic acquisition, WooCommerce was the product that mattered.

Mergers, Acquisitions, and Investments

• Codeable buys back its shares: WordPress freelance marketplace Codeable, founded in 2012 by Tomaž Zaman and Per Esbensen, bought back the shares held by Danish fund CAPNOVA using a loan from the Danish Growth Fund. Zaman said the founders wanted to keep control ahead of any larger future round. Codeable also became a recommended custom development partner for WooCommerce customers.
• WooThemes.com retired: On July 5, the WooThemes.com domain began redirecting to WooCommerce.com, consolidating Automattic’s commerce brand.

WordPress Core Updates

• WordPress 4.6 betas: Beta 2 arrived on July 6, Beta 3 on July 13 and Beta 4 on July 20.
• Release candidate: Published on July 27, with the team aiming to ship on Tuesday, August 16.
• Metadata registration: 4.6 standardised how metadata is registered, laying groundwork for exposing meta through the REST API.
• Recommended PHP version: Aaron Jorbin proposed raising the recommended PHP version from 5.6 to 7.0. Release lead Dominik Schilling indicated the change would come by WordPress 4.8 at the latest, while the minimum requirement was unaffected.
• Responsive themes: Matt Mullenweg said responsive design should be required for themes in the WordPress.org directory, and the Theme Review Team worked to clear bottlenecks in its review queue.
• Better statistics: The WordPress.org stats page was redesigned and began showing installs by language.

Other WordPress News

• Community Summit at WordCamp Europe: Organisers announced that WordCamp Europe 2017 in Paris would host the next WordPress Community Summit.
• WPCampus: The first conference dedicated to WordPress in higher education took place on July 15 and 16, with free livestreams of its sessions. Its survey results later suggested misconceptions about WordPress were slowing adoption at universities.
• Incentivised reviews: The Plugin Directory began cracking down on plugins that offered incentives for reviews, even before an official guideline existed.
• BuddyPress: Development of BuddyPress 2.7 kicked off with a focus on developers and site builders, and the project said BuddyPress 2.8 would raise its minimum PHP requirement to 5.3.
• Commerce: WooCommerce released a Square integration to sync online and offline sales and inventory.
• React and patents: Automattic said it would continue to use React in Calypso despite concerns about the patent clause in Facebook’s license.
• Business milestones: WP Rocket celebrated three years in business and passed $1 million in revenue.
• Events: WordCamp New York City took part in the United Nations’ Open Camps initiative, and WordCamp Warmup was announced as an experimental event to help new attendees break the ice.
• Leadership debate: John James Jacoby published a 35-part tweetstorm on WordPress leadership, community and economics that drew wide discussion.

Security Alerts and Plugin Vulnerabilities

• Summer of Pwnage: By July 20, the programme’s findings had led to updates for 18 plugins, with more than 40 further vulnerabilities still being reported. Ninja Forms fixed multiple cross-site scripting issues, WooCommerce patched an XSS vulnerability, and Paid Memberships Pro, WP Fastest Cache and Easy Forms for MailChimp also released security updates.
• All in One SEO Pack 2.3.7: Patched a persistent cross-site scripting vulnerability on July 11.
• bbPress 2.5.10: Fixed a security vulnerability on July 14.
• TechCrunch hacked: The OurMine group defaced TechCrunch, a WordPress-powered site, by targeting weak passwords, a high-profile reminder that strong credentials mattered as much as patched code.
• Infrastructure patching: WP Engine warned some customers to expect downtime as Linode patched a critical security vulnerability.

Industry Trends and Insights

PHP versions came into focus in July. With PHP 7 offering dramatic speed gains and older branches losing support, WordPress and BuddyPress both signalled they would encourage or require newer versions. It was the beginning of a long effort to drag the hosting world forward, one that would intensify over the next two years.

Governments were also embracing open source. Bulgaria began requiring custom government software to be open source, and the Ford Foundation published a white paper on the challenges of sustaining open-source infrastructure. Google’s removal of Dennis Cooper’s 14-year-old blog from Blogger, meanwhile, became a cautionary tale about building on a platform you do not control, an argument that strengthened the case for self-hosted WordPress.

Theme of the Month: GeneratePress

As Matt Mullenweg pressed for responsive design to be mandatory in the directory, Tom Usborne’s GeneratePress was a good example of what that looked like in practice. Lightweight, responsive and built around the Customizer, it had become a popular free base for site builders who wanted speed without a heavy framework.

Plugin of the Month: WP Rocket

WP Rocket passed $1 million in revenue in July as it celebrated its third anniversary. The premium caching plugin had won users by making performance optimisation work out of the box, and its openly shared growth figures made it a reference point for WordPress product businesses.

Host of the Month: Pagely

Pagely, which had pioneered managed WordPress hosting in 2009, had by 2016 built its platform on Amazon Web Services for larger publishers and businesses. In a month when infrastructure-level security patching caused downtime elsewhere, its pitch of enterprise-grade, carefully managed infrastructure carried extra weight.

Founder of the Month: Tomaž Zaman

Tomaž Zaman, co-founder of Codeable, took the unusual step of buying back an investor’s stake in July to keep the founders in control, while securing a WooCommerce partnership that pointed store owners to Codeable’s vetted freelancers. It was a thoughtful example of a WordPress business managing its own funding on its own terms.

Looking Ahead to August 2016

WordPress 4.6 was scheduled for Tuesday, August 16, after which development of WordPress 4.7, the last release of the year, was due to begin. WordSesh 4 was set for August 19 and 20, and the .blog sunrise period for trademark holders was expected in August.