WordPress News Roundup March 2015: WordPress 4.2 Beta Arrives, WP Engine Raises $23 Million and Yoast Patches SQL Injection

March 2015 put WordPress 4.2 into testers’ hands. Three betas landed in three weeks, bringing a faster plugin update flow, emoji support and a rebuilt Press This, while WordPress.org finished the directory redesign it had started in February.

It was also a month of money and vulnerabilities. WP Engine raised a new round to expand in Europe, and a blind SQL injection in the most popular SEO plugin on WordPress.org showed how quickly the ecosystem could mobilise when a plugin running on more than a million sites needed patching.

Mergers, Acquisitions, and Investments

• WP Engine raises $23 million: On March 25, WP Engine announced a $23 million round led by North Bridge Growth Equity, bringing its total venture funding to $41.2 million. The money was earmarked for growth across Europe, the Middle East and Africa following the opening of its first London office.

Elsewhere, crowdfunding remained the financing of choice for smaller projects. Pods lead developer Scott Kingsley Clark launched a “Friends of Pods” campaign to fund work on the framework, and VersionPress shared the story behind its own crowdfunded launch.

WordPress Core Updates

• WordPress 4.2 betas: Beta 1 arrived on March 12, followed by Beta 2 on March 19 and Beta 3 on March 26.
• Faster plugin updates: 4.2 reworked plugin updates so they happened in place on the Plugins screen without a separate page load, an early piece of what contributors called “Shiny Updates.”
• Enhanced plugin installs cut: A more ambitious redesign of the plugin installation experience was dropped from 4.2 late in the month because it was not ready.
• Version adoption: Updated statistics showed that more than a third of WordPress sites were already running 4.1, a sign that automatic background updates and smoother upgrades were working.
• Security white paper: WordPress published its first official security white paper on March 6, explaining how the core team handles vulnerabilities, updates and hardening.
• REST API 1.2: The WP REST API plugin reached version 1.2 on March 24, while development of version 2 continued ahead of a hoped-for core merge.
• Shortcake: The Shortcake shortcode UI project became an official feature plugin on March 25.

Other WordPress News

• Redesigned Plugin Directory: WordPress.org launched its new Plugin Directory design on March 4. By month’s end, data showed the improved Theme Directory was boosting engagement, even as the commercial themes page recovered from the change.
• WordCamp London 2015: WordCamp London, with its Punk Wapuu mascot and a strong focus on non-profits, showcased the energy of the UK WordPress scene.
• WordCamp Europe 2016 bids: WordCamp Europe opened applications from cities wanting to host the 2016 event.
• Win against DMCA abuse: Automattic and blogger Oliver Hotham won a court case against a man who had filed false DMCA takedown notices, an important result for WordPress.com’s stance on free expression.
• Pakistan blocks WordPress.com: Sites hosted on WordPress.com became inaccessible in Pakistan during the month.
• Akismet encrypts API calls: Akismet moved its API traffic to encrypted connections to protect commenter privacy.
• Telling WordPress’ story: Version one of the WordPress history book was opened for review, the WordPress Foundation website got a redesign, and HeroPress published its first essay.
• Product launches: Easy Digital Downloads 2.3 added a customer management interface, Ninja Forms 2.9 shipped with major performance improvements, and Mark Jaquith released Cache Buddy, a plugin designed to enhance popular WordPress caching solutions.

Security Alerts and Plugin Vulnerabilities

• WordPress SEO by Yoast: Ryan Dewhurst of WPScan responsibly disclosed a blind SQL injection vulnerability that Joost de Valk said affected every version from 1.5 onward. Version 1.7.4 fixed it, along with the corresponding premium release, and hosts including Pressable updated customer sites on their behalf.
• Pods Framework: A security release fixed a severe vulnerability in the Pods framework in mid-March.
• bbPress 2.5.5: The forum plugin patched three potential security vulnerabilities on March 9.
• FancyBox defacements: Attackers used the FancyBox for WordPress flaw disclosed in February to deface unpatched sites with ISIS propaganda, a reminder that unpatched sites remained at risk long after a fix shipped.
• Jetpack Protect: Jetpack 3.4, released on March 18, added the Protect module to block brute force login attacks using data gathered across the Jetpack network.

Industry Trends and Insights

Mobile was the industry story of the month. Google had announced that from April 21 it would use mobile-friendliness as a ranking signal, and site owners spent March checking whether their themes passed its test. For the WordPress ecosystem, which had embraced responsive themes early, it was largely an opportunity, though many older sites needed work.

PHP versions were another emerging concern. The WPupdatePHP project launched to encourage users and hosts to move off old, unsupported PHP releases, a campaign that would grow louder as PHP 7 approached. And the Yoast incident showed the double-edged nature of scale: one bug in one plugin could touch a huge share of the web, but coordinated disclosure and host-level updates could also contain it quickly.

Theme of the Month: Lovecraft

Anders Norén’s Lovecraft arrived in March as a free theme pairing large featured imagery with strong serif typography. It showed that free WordPress.org themes could match commercial design quality, and it joined Norén’s growing catalogue of well-regarded blogging themes.

Plugin of the Month: Jetpack

Jetpack 3.4 brought brute force protection to every connected site with the new Protect module. With botnets hammering wp-login.php across the web, network-wide blocking of known bad IP addresses was a practical security win for millions of self-hosted sites.

Host of the Month: Pressable

After a rough start to the year with outages, Pressable was among the managed hosts that updated customer sites to the patched version of WordPress SEO by Yoast during the March vulnerability. Host-level patching like this was becoming one of the clearest arguments for managed WordPress hosting.

Founder of the Month: Joost de Valk

Joost de Valk, founder of Yoast, faced the biggest security incident in his plugin’s history in March and handled it in public, answering users’ questions and confirming exactly which versions were affected. The quick fix and transparent communication set a useful example for plugin businesses of every size.

Looking Ahead to April 2015

April was expected to bring the final beta, a release candidate and then WordPress 4.2 itself, with release leads for 4.3 and 4.4 due to be named. Google’s mobile-friendly ranking update was scheduled for April 21, and WordCamp Europe applications for 2016 were set to close.