WordPress News Roundup March 2019: WordPress 5.1.1 Release, WordPress Powers One-Third of the Web as PHP 5.6 Becomes the Minimum

March 2019 brought a milestone that WordPress had been approaching for years: according to W3Techs, the software now powered more than one-third of the top 10 million websites. The project marked it while making a decision that would quietly modernise the whole ecosystem, setting PHP 5.6 as the minimum version for WordPress 5.2.

The month also saw a security and maintenance release, the first 5.2 beta with improved fatal error protection, a proposal for a new kind of block-only plugin, and one of the year’s most damaging plugin zero-days. Here is the full picture.

Mergers, Acquisitions, and Investments

No major acquisitions or funding rounds were announced in the WordPress ecosystem in March. The most talked-about company story was not a deal at all: Automattic’s design team published a video, “A Meditation on the Open Web”, that cast closed social platforms like Facebook as the opposite of the open web.

WordPress Core Updates

• WordPress 5.1.1 (March 12): A security and maintenance release with 14 fixes and enhancements. It patched a pair of issues in how comments were filtered and stored, which could allow cross-site scripting through a maliciously crafted comment. It also let hosts offer a button for users to update PHP and made the recommended PHP version filterable.
• PHP 5.6 minimum: In late March, WordPress confirmed that it would end support for PHP 5.2 through 5.5 and require PHP 5.6 from version 5.2, a plan formally announced on April 1, along with coding standards updates.
• WordPress 5.2 Beta 1 (March 27): The first beta brought back improved fatal error protection, new blocks and a block manager.
• Gutenberg 5.3: Released on March 20, it added a block manager modal for hiding blocks and allowed nesting inside the Cover block.
• Triage Team: A new team led by Jonathan Desrosiers was introduced to manage the growing backlog of tickets in Trac.
• New theme hook: A wp_body_open hook was added for 5.2, giving theme and plugin developers a standard place to insert code after the opening body tag.

Other WordPress News

• One-third of the web: WordPress.org celebrated passing a third of the top 10 million sites on March 15, crediting the volunteers behind the project.
• Block Directory proposal: The Meta team proposed a new type of “single block” plugin, searchable and installable from inside the editor through a dedicated Block Directory.
• PHP notice working: The PHP upgrade notice added in WordPress 5.1 was now nudging site owners on outdated versions to upgrade.
• WordCamp Nordic: The first WordCamp Nordic took place in Helsinki on March 7–8, including a workshop for children.
• WordCamp Miami: More than half of the speakers at WordCamp Miami were women, and its Kid’s Camp drew over 100 young attendees.
• WordCamp Asia proposed: Organizers proposed a first WordCamp Asia for Bangkok, Thailand in 2020.
• Translation Day returns: Planning continued for the fourth Global WordPress Translation Day on May 11.
• Theme Sniffer released: The Theme Review team published Theme Sniffer in the Plugin Directory, alongside automated accessibility testing tools.
• WordCamp Europe schedule: The schedule for Berlin, June 20–22, was published.

Security Alerts and Plugin Vulnerabilities

• Social Warfare zero-day: On March 21, Wordfence warned that an unpatched vulnerability in the Social Warfare sharing plugin was being exploited to inject malicious redirects into sites. A fix followed quickly, and further analysis showed the flaw could also allow remote code execution.
• Easy WP SMTP: Attackers began abusing a recently patched flaw in the Easy WP SMTP plugin, which could let them change site settings and create administrator accounts.
• Abandoned Cart XSS: Wordfence reported on March 11 that an XSS flaw in an abandoned cart plugin for WooCommerce was being used to take over sites.
• Freemius SDK: In the last days of February, Freemius patched a severe vulnerability in its SDK, used by many popular plugins, and plugin authors shipped updated versions into early March.
• Pipdig controversy: On March 29, Wordfence and others raised concerns about code in the Pipdig Power Pack plugin, sparking a wider debate about trust in commercial theme vendors.
• Core comment fix: The 5.1.1 comment issue had been reported independently by Simon Scannell of RIPS Technologies and Ronni Skansing of Prueba Cybersecurity, and was disclosed privately so it could be patched first.

Industry Trends and Insights

• A third of the web: Passing 33 percent reinforced WordPress’s dominance, but also its responsibility. Decisions about security, accessibility and performance now affected a third of websites.
• Modern PHP at last: Requiring PHP 5.6 freed developers to use more modern language features and gave hosts a firm reason to upgrade customers.
• Blocks as an app store: The Block Directory proposal suggested a future in which users discover functionality from inside the editor rather than browsing plugins.
• Plugin supply chain risk: The Social Warfare and Freemius incidents showed how a single plugin or shared library could expose a very large number of sites at once.

Theme of the Month: Divi

Elegant Themes’ Divi remained one of the best-selling WordPress themes, combining a theme with its own visual builder. As the block editor matured, Divi’s large user base was a reminder that many site owners still preferred an all-in-one design tool.

Plugin of the Month: Query Monitor

John Blackbourn’s Query Monitor is the debugging panel many developers install first. With PHP 5.6 becoming the minimum and 5.2’s fatal error protection in testing, a tool that surfaces PHP errors, slow queries and hooks was especially useful in March.

Host of the Month: Cloudways

Cloudways offered managed hosting on top of cloud providers such as DigitalOcean, Vultr and AWS, with control over the PHP version on each server. That flexibility suited site owners responding to WordPress’s new PHP requirements.

Founder of the Month: Vova Feldman

Vova Feldman founded Freemius, the monetisation and analytics platform used by many commercial WordPress plugins and themes. When a serious flaw was found in the Freemius SDK at the end of February, the team patched it within hours and coordinated with plugin authors, a useful model of responsible handling for shared code.

Looking Ahead to April 2019

April should bring further WordPress 5.2 betas and a release candidate, with the final release scheduled for the end of the month. Site Health, fatal error protection and the PHP 5.6 minimum will be the main things to test. The Block Directory proposal and planning for the Translation Day in May will continue.