WordPress News Roundup March 2014: WordPress 3.9 Betas Arrive as 162,000 Sites Are Used in a Pingback DDoS

March 2014 put WordPress 3.9 into testers’ hands. Three betas in under three weeks showcased a faster visual editor, live widget previews and easier image editing. At the same time, a security firm showed how WordPress’s default pingback feature could be turned against other websites at scale, reviving an old debate about XML-RPC.

The plugin directory passed 30,000 plugins, another big host launched a managed WordPress product, and WordCamp Europe picked its next city.

Mergers, Acquisitions, and Investments

• Autodesk acquires Creative Market: Creative Market, the design marketplace that had moved to 100% GPL WordPress themes in 2013, was acquired by Autodesk, the maker of AutoCAD.
• 10up hires a CEO: Agency 10up hired a chief executive to help take the growing company to its next stage.

WordPress Core Updates

• Widget Customizer merged: On March 5 the Widget Customizer was officially merged into core for 3.9.
• WordPress 3.9 Beta 1 (March 11): Beta 1 introduced TinyMCE 4 with cleaner markup and much better pasting from Microsoft Word, widget management in the Customizer, header image cropping without leaving the preview, the 3.8-style theme browser in the theme installer, live gallery previews in the editor, drag-and-drop image uploads, easier image editing and new audio and video playlists.
• Beta 2 (March 20) and Beta 3 (March 29): Beta 2 rendered audio and video players inside the visual editor, and Beta 3 added HTML5 caption support for themes and a much faster texturize function. The release date was then set for April 16.
• Multisite security work: Core developers targeted WordPress 4.0 to fix how multisite handled passwords for new users.
• Developer Reference testing: Volunteers were invited to test the code reference that would become developer.wordpress.org.

Other WordPress News

• WordCamp Europe 2014 in Sofia: Organisers announced that WordCamp Europe 2014 would be held in Sofia, Bulgaria.
• 30,000 plugins: The WordPress.org plugin directory passed 30,000 plugins on March 20.
• Media Temple’s Premium WordPress: Media Temple launched managed WordPress hosting at $29 a month for three installs, operating independently of its parent GoDaddy.
• CampusPress: CampusPress launched managed hosting for WordPress multisite networks, aimed at schools and universities.
• WordPress.com marketplace opens: WordPress.com formally invited outside developers to sell premium themes in its marketplace.
• Better WP Security becomes iThemes Security: iThemes announced the plugin would be renamed and overhauled, then worked to fix upgrade problems at the end of the month.
• Developer tools: PhpStorm 8 announced official WordPress support, WordPress for iOS 4.0 shipped with better stats, and BuddyPress 2.0 Beta 1 arrived on March 28.
• Gravatar app in the works: Automattic revealed that an official Gravatar mobile app was under development.
• Pressgram 2.0: Pressgram removed its social layer to focus purely on publishing photos to WordPress.
• WordCamp Dayton: The first WordCamp Dayton, Ohio, was held in early March and judged a success by organisers and attendees.
• Treehouse adds BuddyPress: Treehouse expanded its WordPress courses with a beginner’s course on BuddyPress.

Security Alerts and Plugin Vulnerabilities

• Pingback DDoS: Sucuri reported in early March that more than 162,000 legitimate WordPress sites had been used to flood a single target with requests in just a few hours. The attackers abused the XML-RPC pingback feature, which was enabled by default. Sucuri recommended disabling pingbacks or XML-RPC, while Matt Mullenweg argued that disabling XML-RPC was not the right fix.
• Akismet update: An Akismet update brought security and anti-spam improvements.
• Untrusted plugin sources: WP Tavern warned about installing “free” copies of commercial plugins from untrusted sites, a common route for malware.

Industry Trends and Insights

• Every major host wants managed WordPress: After GoDaddy in January, Media Temple’s launch meant both GoDaddy-owned brands now sold managed WordPress to different audiences.
• Scale cuts both ways: The pingback attack showed that WordPress’s ubiquity could be weaponised even when individual sites were not compromised.
• A maturing directory: 30,000 free plugins was a powerful selling point, and a growing challenge for quality, support and security.

Plugin of the Month: iThemes Security

The renamed Better WP Security was one of the most installed security plugins on WordPress.org. Its rebrand and rebuild under iThemes, after February’s security fixes, showed the company investing heavily in the security category.

Host of the Month: CampusPress

CampusPress, from the team behind Edublogs, focused on a niche that general hosts struggled to serve: large WordPress multisite networks for education. Its launch this month showed managed hosting specialising by audience as well as by price.

Founder of the Month: Daniel Cid

Daniel Cid, founder and CTO of Sucuri, published the research on the 162,000-site pingback attack this month. His work helped site owners understand a risk that came from WordPress’s defaults rather than from any one vulnerable plugin.

Looking Ahead to April 2014

WordPress 3.9 is scheduled for April 16, with release candidates first. BuddyPress 2.0 is expected in mid-April, and Google Summer of Code projects will be announced. WordPress 4.0 planning should begin soon after 3.9 ships.