WordPress News Roundup March 2007: Tampered 2.1.1 Download Forces WordPress 2.1.2 as the Plugin Directory Launches

March 2007 opened with the most serious security incident WordPress.org had faced. On March 2 the team revealed that the WordPress 2.1.1 download had been altered by an attacker and told everyone running it to upgrade to 2.1.2 immediately. The rest of the month was more upbeat: a new official Plugin Directory launched, WordPress was accepted into Google Summer of Code, and plans for a second WordCamp in San Francisco were announced.

Mergers, Acquisitions, and Investments

There were no acquisitions or investment rounds this month. Automattic did keep growing its team, welcoming a new developer, Demitrious, known online as apokalyptik, in mid-March.

WordPress Core Updates

• WordPress 2.1.2 (March 2): Released to replace the compromised 2.1.1 package, with minor updates and verified files. The announcement urged users to overwrite all old files, especially in wp-includes.
• Next major release: Development continued on what would become WordPress 2.2, still officially targeted for April 23.

Other WordPress News

• Plugin Directory launches: On March 15, WordPress.org opened a central plugin directory in its new Extend section. Users could browse, rate and comment on plugins in one place, while developers got free Subversion hosting for GPL plugins, automatic download packages and usage statistics. Michael Adams, Mark Jaquith and Matt Thomas were credited with building it.
• Google Summer of Code: WordPress was one of 131 projects accepted into Google’s 2007 programme from more than 300 applicants, opening paid summer work to students.
• SXSW: Matt Mullenweg wrote about WordPress at South by Southwest, where he spoke and handed out stickers, and an Austin meetup took place around the event.
• WordCamp 2007 announced: Mullenweg confirmed a second WordCamp would be held in San Francisco later in the year.
• OpenID on WordPress.com: Every WordPress.com blog address could now be used as an OpenID.
• Paid links banned: WordPress.com barred the PayPerPost paid-post service, a stance Mullenweg explained in a post on selling links.
• Akismet milestone in sight: Mullenweg invited readers to guess when Akismet would pass one billion spam messages caught.

Security Alerts and Plugin Vulnerabilities

A cracker gained user-level access to one of the servers behind WordPress.org and modified two files in the 2.1.1 download to allow remote PHP execution. Not every copy was affected, but the team treated the whole release as compromised, took the site down to investigate, locked down the server for forensic analysis and reset passwords for some users with commit access.

• Who was affected: Only the 2.1.1 download package. The 2.0 branch and the Subversion repository were untouched.
• Advice for hosts: Network administrators were asked to block requests to theme.php and feed.php carrying the query strings “ix=” or “iz=”.
• Longer-term fix: The team promised external verification of download packages to catch future tampering.

Industry Trends and Insights

The plugin directory recognised something the community already knew: much of WordPress’s value lived outside core. Giving plugin authors hosting, statistics and exposure to WordPress.org’s audience helped turn a scattered collection of downloads into a real ecosystem. At the same time, the 2.1.1 incident showed that the project’s own infrastructure had become a target worth attacking.

Theme of the Month: Hemingway

Kyle Neath’s Hemingway, with its dark, minimal two-column look and modular “blocks” at the bottom of the page, was one of the most imitated free themes of the era. It showed how far a WordPress design could move from the default Kubrick style.

Plugin of the Month: Google XML Sitemaps

Arne Brachhold’s Google XML Sitemaps generator was one of the essential plugins that the new directory made easier to find. It automatically built sitemap files that helped search engines discover a site’s posts and pages, a job WordPress core would not take on for many years.

Founder of the Month: Matt Mullenweg

Mullenweg handled the 2.1.1 disclosure in public, launched the plugin directory and spent part of the month at SXSW, the conference he credited as his first tech event. His decision to publicise the incident widely set a tone of openness about security.

Looking Ahead to April 2007

April was expected to bring WordPress 2.2 on its April 23 target date, along with the announcement of the first Summer of Code students. Site owners still running 2.1.1 remained the most urgent concern for the security team.