WordPress News Roundup March 2016: WordPress 4.5 Release Candidate, a Plugin Backdoor and Modern Tribe Buys GigPress

March 2016 was a month of steady progress on WordPress 4.5 and an unsettling lesson about plugin ownership. Three betas and a release candidate brought inline link editing and responsive Customizer previews close to launch, while the Custom Content Type Manager plugin was found to have been turned into a backdoor by a newly added maintainer.

The ecosystem was busy too. Modern Tribe picked up GigPress, Shopify and Facebook-focused publishing tools arrived on WordPress, a new forms plugin made a confident debut, and the project formally adopted accessibility coding standards for all new code.

Mergers, Acquisitions, and Investments

• Modern Tribe acquires GigPress: Modern Tribe, maker of The Events Calendar, acquired the GigPress plugin for musicians and performers on March 28, and said it was exploring a software-as-a-service approach to events management.
• Automattic takes control of Pressable: On March 10 Automattic took a majority stake in the managed WordPress host by buying CEO Vid Luther’s shares.

WordPress Core Updates

• WordPress 4.5 betas: Beta 2 arrived on March 3, Beta 3 on March 10 and Beta 4 on March 17.
• Release candidate: Published on March 24 with 49 changes since Beta 4, targeting Tuesday, April 12.
• What 4.5 would bring: Inline link editing in the visual editor, improved comment moderation screens, oEmbed support for Twitter Moments and timelines, and selective refresh support for widgets, which theme developers were urged to prepare for.
• WP-CLI compatibility: Versions of WP-CLI before 0.23.0 were found to be incompatible with WordPress 4.5, prompting an upgrade notice for hosts and developers.
• Accessibility standards: On March 22, WordPress adopted accessibility coding standards for all new and updated code in core.
• Customize Snapshots: A new feature plugin let users draft and save Customizer changes for later, an idea that would become Customizer changesets in 4.7.

Other WordPress News

• WordPress.org redesign research: User experience research began on March 31 as the first stage of a long-term redesign of WordPress.org.
• WordCamp Europe expands: The Vienna event raised its capacity to 2,200 attendees, making it the largest WordCamp to that date.
• Jetpack turns five: Jetpack celebrated its fifth birthday by moving to the jetpack.com domain.
• BuddyPress 2.5.0: Released on March 2 with customisable emails and emoji support.
• Publishing platforms: Automattic released a plugin for Facebook Instant Articles, a plugin for Apple News Publisher became available, and Shopify launched an official WordPress plugin for selling products on WordPress sites.
• Themes and review: The Theme Review Team moved towards automating parts of its review process to reduce long queues.
• Recognition: Accessibility contributor Rian Rietveld won a Heroes of Accessibility award, and HeroPress marked its first year with essays from 18 countries.
• Events: PressNomics 4 took place in Phoenix on March 3 and 4, and the first WPCampus was scheduled for July 15 and 16.
• W3 Total Cache: Frederick Townes confirmed that W3 Total Cache was not abandoned despite a long gap between updates.
• Mental health: Burnout among full-time contributors was widely discussed during the month, with Cory Miller and Pippin Williamson among those speaking openly about it.

Security Alerts and Plugin Vulnerabilities

• Custom Content Type Manager backdoor: A user named wooranker was added as a maintainer of the plugin, which ran on more than 10,000 sites, and on February 19 pushed an update containing an auto-update file that could be used to upload a shell to sites. After a site owner reported a hack on March 1, Sucuri’s Denis Sinegubko published an analysis, and WordPress.org restored a clean version, though affected sites still had to remove the malicious files themselves.
• Password hashing: The Roots team released wp-password-bcrypt, a plugin replacing WordPress’ default password hashing with bcrypt, drawing attention to core’s reliance on the older phpass library.
• Host security: WP Engine added two-factor authentication to its user portal, three months after its credential breach.

Industry Trends and Insights

Distributed publishing was the trend of the month. With Facebook Instant Articles, Apple News and Google AMP all courting publishers, WordPress plugins quickly became the bridge between a site and each of these platforms. WordPress’ role as a source of content for other channels was growing alongside its role as a website builder.

Stack Overflow’s 2016 developer survey again placed WordPress among the most dreaded technologies, even as it showed WordPress usage trending up. And the Custom Content Type Manager case raised a question the ecosystem had not answered: how should users be protected when a trusted plugin quietly changes hands or gains new committers?

Theme of the Month: Dyad

Dyad, a free theme from Automattic released in March, was designed for photographers and food bloggers, with an image-led layout. It was a strong example of the visual, content-specific themes Automattic was releasing for both WordPress.com and WordPress.org.

Plugin of the Month: WPForms

WPForms launched in March with the goal of being the most beginner-friendly forms plugin for WordPress, built around a drag-and-drop builder. In a category long dominated by Gravity Forms, Contact Form 7 and Ninja Forms, it quickly found an audience among non-technical site owners.

Host of the Month: WP Engine

WP Engine added two-factor authentication to its user portal in March and said opt-in PHP 7 support was in the works. After the December breach, visible security improvements and a path to faster PHP were exactly what its customers wanted to see.

Founder of the Month: Shane Pearlman

Shane Pearlman, co-founder of Modern Tribe, oversaw the acquisition of GigPress in March. With The Events Calendar already one of WordPress’ leading event plugins, the deal and the company’s interest in software-as-a-service showed a mature WordPress product business looking beyond the plugin model.

Looking Ahead to April 2016

WordPress 4.5 was scheduled for April 12, with Mike Schroder leading the release. WordCamp London was set for early April, and the first Global WordPress Translation Day was scheduled for April 24, with development of 4.6 due to begin soon after 4.5 shipped.