WordPress News Roundup June 2014: WP Engine Funds Core Contributors and a TimThumb Zero-Day Returns

June 2014 was a development month. There were no WordPress releases and no posts on the official news blog, as contributors worked toward WordPress 4.0 and its plans for better internationalisation, a new plugin installer and a redesigned Press This. The bigger headlines came from the businesses around WordPress: a major host committed to paying for core development, two long-running theme shops changed hands, and a security flaw resurfaced in a script that had haunted WordPress themes for years.

Mergers, Acquisitions, and Investments

• Westwerk acquires Press75: On June 3 Jason Schuller announced that Press75, the video-focused theme shop he founded in 2008, had been bought by Westwerk, parent of the agency WerkPress. The price was undisclosed after an earlier Flippa auction.
• ThemeShift acquired: Michael Oeser of DER PRiNZ bought the theme company ThemeShift.
• PressWork relaunch: The PressWork theme framework was set to relaunch under new ownership.
• Crowd Favorite to acquire Forty: On June 14 Crowd Favorite signed a letter of intent for Forty, a six-person UX and design agency in Arizona, to join it in a stock purchase.

WordPress Core Updates

• Internationalisation in 4.0: Core developers outlined major i18n improvements planned for WordPress 4.0, including choosing a language during installation.
• Press This redesign: An alpha plugin previewing a redesigned Press This bookmarklet was released for testing.
• Menu Customizer: An alpha plugin for managing menus in the Customizer appeared, following the Widget Customizer’s path.
• Beta testing tab: Trunk gained a beta-testing tab on the plugins screen to encourage people to try feature plugins.
• New oEmbed providers: More embed providers were lined up for 4.0.
• JSON REST API 1.1: The REST API plugin released version 1.1 with new authentication documentation.

Other WordPress News

• WP Engine sponsors two core developers: On June 11 WP Engine said it was hiring two developers to work full-time on WordPress core, following 10up’s sponsorship of Helen Hou-Sandí in 2013.
• WordPress.com SSL for all: WordPress.com announced it would enable SSL on all its subdomains, framed as part of the fight against mass surveillance.
• Vietnamese at 100%: WordPress was fully translated into Vietnamese.
• Forbes interview: Forbes published an extended interview with Matt Mullenweg, which Matt also shared on his blog.
• Community Summit at WCSF: WordCamp San Francisco announced it would host a WordPress Community Summit and contributor meetups, and tickets for WordCamp Europe 2014 went on sale.
• VersionPress: VersionPress, a project to bring Git-style version control to WordPress sites, launched a crowdfunding campaign and adopted the GPL.
• DMCA over a fork: A DMCA takedown notice was issued against a public fork of WP Migrate DB Pro, sparking debate about GPL rights and distribution.
• WordPress for Android 2.9: The Android app added a blog-discovery feature.
• WP-CLI 0.16: The command-line tool added WP-Cron management and verification of core files against official checksums, useful for spotting tampered installs.
• Two-step login for one-click installs: Clef partnered with Softaculous to offer two-step authentication on automated WordPress installations.
• Support forum history: New data showed WordPress.org support forum registrations surged between 2009 and 2012, mirroring the platform’s rapid growth.

Security Alerts and Plugin Vulnerabilities

• TimThumb “Webshot” zero-day: On June 25 a vulnerability was disclosed in TimThumb 2.8.13’s Webshot feature that, when enabled, allowed remote command execution. No patch was initially available, and Sucuri advised checking that WEBSHOT_ENABLED was set to false.
• bbPress 2.5.4: A security release for bbPress was published on June 7, with an immediate update recommended.
• Pods: The Pods framework released an update to patch a security vulnerability.

Industry Trends and Insights

• Companies paying for core: WP Engine joining 10up in sponsoring full-time contributors marked a shift toward businesses funding WordPress development directly.
• Encryption by default: WordPress.com’s SSL plan reflected the wider industry move to HTTPS after the 2013 surveillance revelations.
• Form plugins everywhere: A report that Gravity Forms was detected on many of the top million sites using hosted forms showed how commercial plugins had become infrastructure.

Theme of the Month: Ravel

Ravel, released through Justin Tadlock’s Theme Hybrid with design by Tung Do, was a modern, carefully crafted theme that showed what a free, standards-focused design could look like in 2014.

Plugin of the Month: JSON REST API

Version 1.1 of the JSON REST API added clearer authentication documentation just a month after 1.0. For developers building apps and JavaScript front ends on WordPress, it was the most important feature plugin in progress.

Host of the Month: WP Engine

After a bruising May over customer support, WP Engine made one of the most constructive announcements of the month by committing to fund two full-time WordPress core developers from its Austin base.

Founder of the Month: Jason Schuller

Jason Schuller built Press75 into one of the longest-running WordPress theme shops before experimenting with projects such as Dropplets. Selling Press75 this month closed a chapter for an early commercial theme pioneer.

Looking Ahead to July 2014

WordPress 4.0 Beta 1 is expected in July, with media library, embed and plugin installer changes to test. VersionPress’s crowdfunding campaign ends, and preparations continue for WordCamp Europe in September and WordCamp San Francisco in October.