WordPress News Roundup June 2011: WordPress 3.1.4 Release, Backdoored Plugins Force a WordPress.org Password Reset as 3.2 Reaches Release Candidate

June 2011 brought one of the most alarming security incidents the plugin directory had seen up to that point. On June 21 the WordPress team revealed that someone had committed hidden backdoors to three popular plugins, AddThis, WPtouch and W3 Total Cache, using developer accounts that did not belong to the attacker. The team rolled the changes back, pushed out clean updates and reset passwords on WordPress.org as a precaution.

Meanwhile WordPress 3.2 moved steadily towards launch, with three release candidates in the space of two weeks and a final security release for the 3.1 branch at the end of the month.

Mergers, Acquisitions, and Investments

No WordPress-related acquisitions or funding rounds were announced in June 2011.

WordPress Core Updates

• WordPress 3.2 RC1 (June 14): The first release candidate signalled that the team believed 3.2 was ready, while asking users to test against the huge range of plugins, themes and server setups in use.
• WordPress 3.2 RC2 (June 24): RC2 fixed issues found since RC1, including more refinements to the new Twenty Eleven theme and a new theme support option.
• WordPress 3.1.4 and 3.2 RC3 (June 29): WordPress 3.1.4 was a maintenance and security release for all previous versions, shipped alongside the third 3.2 release candidate.

Other WordPress News

• Newsrooms and government: The New York Observer moved its site from Drupal to WordPress, and the new Consumer Financial Protection Bureau ran consumerfinance.gov entirely on WordPress. Mullenweg highlighted several other US government sites using the platform.
• Blocked in Central Asia: Access to WordPress sites was blocked or degraded in Kazakhstan and Kyrgyzstan. Mullenweg said WordPress had received no contact from Kazakh Telecom about the block.
• Developer resources: Core developer Mark Jaquith shared tips on local WordPress development, and Mark Maunder published benchmarks comparing the MyISAM and InnoDB storage engines for WordPress sites.
• A sense of scale: One widely shared figure that month suggested that every 60 seconds the web saw more than 50 WordPress downloads and more than 60 new WordPress blogs.

Security Alerts and Plugin Vulnerabilities

June showed that the plugin directory itself could be a route for attack, not just the code people wrote.

• Backdoored plugins (June 21): The WordPress team found suspicious commits to AddThis, WPtouch and W3 Total Cache that contained hidden backdoors. It confirmed the plugin authors had not made the changes, reverted them, released updated versions and temporarily shut down access to the repository while it checked for other problems.
• Password reset: As a precaution, every WordPress.org password was reset, with the same step taken on bbPress.org and BuddyPress.org. Users of the three plugins who might have updated in the previous day were told to upgrade again to the latest versions, and everyone was reminded not to reuse passwords across services.
• WordPress 3.1.4 (June 29): This release fixed a flaw that could let a malicious Editor-level user gain further access to a site. It was reported by K. Gudinavicius of SEC Consult, and the release also included other hardening.

Industry Trends and Insights

The plugin backdoor incident was an early example of what would later be called a supply chain attack. Because WordPress sites updated plugins from a central directory, one compromised developer account could reach many thousands of sites. The quick response limited the damage, but the case started a long conversation about account security for plugin authors.

• Drupal to WordPress: The New York Observer’s move added to a growing list of publishers choosing WordPress over more complex CMS platforms.
• Social competition: Google launched Google+ on June 28, adding another social network competing for people’s attention and writing. Its arrival renewed debate about whether people would keep publishing on their own sites.

Theme of the Month: Carrington

Carrington, the theme framework from Alex King’s Crowd Favorite, offered a different approach from most themes, using a context-aware template system to pick the right layout for each view. It was popular with developers building custom publishing sites, the kind of projects that were increasingly moving to WordPress from other platforms.

Plugin of the Month: WP Super Cache

WP Super Cache, created by Donncha Ó Caoimh, turned dynamic WordPress pages into static files so sites could cope with traffic spikes on modest hosting. With WordPress 3.2 focused on speed, page caching was one of the simplest ways for site owners to make their sites faster still.

Host of the Month: DreamHost

DreamHost was a long-standing WordPress-friendly host with one-click installs and a strong following among bloggers and developers. As WordPress prepared to require newer versions of PHP and MySQL, established hosts like DreamHost were already running environments that met the new minimums.

Founder of the Month: Donncha Ó Caoimh

Donncha Ó Caoimh, an early Automattic employee from Ireland, created WP Super Cache and led WordPress MU, the multisite version of WordPress that was merged into core in 2010. His work on caching and multisite underpinned much of how large WordPress installations ran.

Looking Ahead to July 2011

WordPress 3.2 was expected to ship in early July, with its new requirements of PHP 5.2.4 and MySQL 5.0 and the new Twenty Eleven default theme. WordCamp San Francisco organisers were also reviewing speaker applications for the August event.