WordPress News Roundup June 2013: WordPress 3.5.2 Security Release and Page.ly Buys BlogDroid

June 2013 was about security and consolidation. WordPress shipped its second security release of the year, a research firm found vulnerabilities in a large share of the most popular plugins, and managed hosting saw what appeared to be its first acquisition of one host by another. WordPress 3.6, now without its Post Formats UI, kept moving through beta.

The month also had a celebratory note, as co-founder Mike Little received an award in Manchester, and a philanthropic one, as Matt Mullenweg backed a landmark San Francisco art installation.

Mergers, Acquisitions, and Investments

• Page.ly acquires BlogDroid: On June 26 Page.ly announced it had bought BlogDroid, a fast-growing managed WordPress host co-founded by Karen Jackie. The all-cash deal’s terms were not disclosed. BlogDroid customers were to move to Page.ly’s platform, in what WP Tavern described as the first time one managed WordPress host had acquired a competitor.
• Automattic acquires Poster: On June 17 Automattic bought Poster, a third-party iOS app for WordPress. Its developer Tom Witkin joined the WordPress mobile team, and Poster was pulled from the App Store.

WordPress Core Updates

• WordPress 3.5.2: Released on June 21, 3.5.2 fixed 12 bugs and seven security issues: server-side request forgery, contributors improperly publishing posts or reassigning authorship, cross-site scripting in the SWFUpload and TinyMCE libraries, a denial-of-service risk on password-protected posts, several further XSS issues, and full-path disclosure on failed uploads.
• WordPress 3.6 Beta 4: Released alongside 3.5.2, Beta 4 included the same security fixes and continued polishing revisions, autosave and the media player after the Post Formats UI was removed.
• SWFUpload retired: Core developers published guidance on securing SWFUpload, encouraging plugin authors to move off the ageing Flash uploader.

Other WordPress News

• Mike Little honoured: WordPress co-founder Mike Little received SAScon’s first Outstanding Contribution to Digital award at the event in Manchester in early June.
• Matt Mullenweg and The Bay Lights: Matt donated $1.5 million to The Bay Lights, the LED installation on San Francisco’s Bay Bridge, and appeared on This Week in Startups and in CNN Money coverage during the month.
• Matt Cutts moves to Genesis: Google’s head of webspam switched his personal blog from Thesis to the Genesis Framework, a small but widely shared endorsement for StudioPress.
• Automattic’s distributed culture: Toni Schneider spoke publicly about running Automattic as a distributed workforce, and the company drew praise for the number of women in its ranks.
• New community resources: Brian Richards launched WPSessions, an online learning series, while GenerateWP’s code generators and the PressForward feed-reading plugin were highlighted as useful tools for developers and publishers.
• The WordPress Importer: Concerns grew about the slow pace of fixes to the official WordPress Importer, a plugin many migrations depended on.

Security Alerts and Plugin Vulnerabilities

• Checkmarx plugin report: On June 18, security firm Checkmarx published an analysis of the 50 most downloaded plugins in the WordPress.org directory and found that more than 20% were vulnerable to common attacks such as SQL injection. It also reported that 7 of the 10 most popular e-commerce plugins contained vulnerabilities. The research concerned plugins, not WordPress core.
• Core fixes in 3.5.2: The core release closed seven issues, several of them in third-party libraries bundled with WordPress.

Industry Trends and Insights

• PHP 5.5 arrives: PHP 5.5.0 was released on June 20 with a built-in opcode cache. WordPress still supported PHP back to 5.2.4, and the gap between what hosts offered and what was current kept widening.
• Managed hosting consolidates: Page.ly’s deal showed the young managed WordPress hosting market was already maturing.
• Plugin quality is the weak spot: Checkmarx’s findings reinforced that WordPress’s security reputation increasingly depended on its plugin ecosystem.
• Google Reader countdown: With Reader closing on July 1, publishers looked for ways to keep RSS readers, from Feedly-style services to self-hosted options.

Theme of the Month: Genesis Framework

StudioPress’s Genesis Framework had been popular for years, but Matt Cutts choosing it for his own blog gave it a fresh round of attention. Its child-theme model, clean markup and SEO-friendly reputation made it the premium framework of choice for many developers in 2013.

Plugin of the Month: PressForward

PressForward, a project from the Roy Rosenzweig Center for History and New Media, turned WordPress into a feed reader and curation tool. With Google Reader weeks from closing, a way to collect, discuss and republish RSS content inside WordPress was perfectly timed.

Host of the Month: Page.ly

Page.ly, one of the first managed WordPress hosts, grew by buying a competitor this month. Absorbing BlogDroid’s customers showed confidence in its platform and signalled that scale was becoming important in managed WordPress hosting.

Founder of the Month: Matt Mullenweg

Fresh from the 10th anniversary, Matt Mullenweg was everywhere in June: funding The Bay Lights, giving interviews on Automattic’s growth and preparing for WordCamp San Francisco, where he would set out the next phase of WordPress development.

Looking Ahead to July 2013

WordPress 3.6 release candidates are expected in July, with the final release close behind. WordCamp San Francisco runs July 26–28, with Matt’s State of the Word and results from the annual WordPress survey. Google Reader closes on July 1.