WordPress News Roundup March 2020: WordPress 5.4 “Adderley” Ships as COVID-19 Moves WordCamps Online

March 2020 was a difficult month for the WordPress community and an important one for the software. With COVID-19 declared a pandemic, WordCamps and meetups around the world were postponed or cancelled, and contributors adjusted to new pressures at home and work. Even so, WordPress 5.4 “Adderley” shipped on schedule on March 31.

The month also introduced block patterns in the Gutenberg plugin, an idea that would quickly reshape how themes and page layouts were built, and brought WooCommerce 4.0. Security researchers reported serious flaws in several popular plugins, including a widely used SEO tool.

Mergers, Acquisitions, and Investments

No significant WordPress acquisitions were announced in March. The developer world’s biggest deal was GitHub’s acquisition of npm, announced mid-month, which brought the JavaScript package registry used by WordPress’s own build tools under Microsoft’s ownership.

WordPress Core Updates

• Five release candidates: RC1 arrived on March 3, followed by RC2 on March 10, RC3 on March 17, RC4 on March 24 and RC5 on March 28. The 5.4 Field Guide detailed the changes.
• WordPress 5.4 “Adderley” (March 31): Named after jazz saxophonist Cannonball Adderley, 5.4 added Social Icons and Buttons blocks, more colour options, a welcome guide, and a fullscreen editor by default. It also improved privacy tools and accessibility and added developer APIs.
• Block patterns arrive: Gutenberg 7.7 introduced block patterns, predefined layouts users could insert and adapt, alongside a refreshed block toolbar. Gutenberg 7.8 on March 25 added a patterns API and continued the interface clean-up.
• Auto-updates progress: Version 0.3 of the auto-updates feature plugin, with email notifications, was released on March 16.
• Modern PHP standards: Contributors proposed coding standards for namespaces, type declarations and other modern PHP features ahead of WordPress Coding Standards 3.0.
• GitHub accounts on profiles: Contributors could now connect a GitHub account to their WordPress.org profile for better credit.

Other WordPress News

• Events paused: The Community Team issued new recommendations for organisers on March 11, and organisers responsibly postponed or cancelled upcoming WordCamps and meetups. The team offered online conference training and proposed interim event guidelines.
• WordCamp Europe postponed: Organisers decided to postpone the Porto event to 2021.
• WordCamp US plans: WordCamp US said its 2020 event would go ahead one way or another and opened its call for speakers and a call for host cities for 2021 and 2022.
• 2020 goals update: Project leadership posted an update on 2020 goals, including full site editing.
• WooCommerce 4.0: Released on March 11, it introduced a new React-based admin interface and onboarding experience.
• Free training: Yoast published a free online course on using the block editor.
• Virtual speaker training: The diverse speaker training group encouraged communities to run its workshops online while in-person events were on hold.
• Block templates: Gutenberg Hub launched a collection of 100 block templates, an early community take on the ideas behind block patterns.
• Remote work: As offices closed, WordPress’s distributed companies shared lessons for teams going remote for the first time.
• People of WordPress: The series profiled Mary Job from Nigeria.

Security Alerts and Plugin Vulnerabilities

• Rank Math: On March 31, Wordfence disclosed critical vulnerabilities, since patched, in the Rank Math SEO plugin, used on over 200,000 sites, including one that could let unauthenticated attackers grant themselves administrator privileges.
• ThemeREX Addons patched: The zero-day exploited in February was patched on March 9.
• Popup Builder: Vulnerabilities affecting more than 100,000 sites were fixed in Popup Builder, including one that could inject malicious code into pop-ups.
• Responsive Ready Sites Importer: Severe flaws were patched in this importer plugin on March 18.
• Custom Searchable Data Entry System: Attackers exploited a zero-day in this plugin that let unauthenticated visitors tamper with the data it stored.
• Others: Fixes also landed in Import Export WordPress Users, Data Tables Generator by Supsystic and IMPress for IDX Broker.

Industry Trends and Insights

• The web as lifeline: As lockdowns spread, businesses, schools and charities rushed to get online, and WordPress, WooCommerce and online events tools became essential.
• Patterns change the game: Block patterns promised to make attractive layouts accessible to non-designers and gave theme authors a new way to deliver value.
• A new shape for community: The move to online events raised questions about how to preserve the hallway conversations and contributor days that bring people into the project.
• JavaScript supply chain: GitHub’s purchase of npm put another key piece of WordPress developer infrastructure under one large company.

Theme of the Month: Twenty Twenty

Twenty Twenty remained the default theme in WordPress 5.4 and paired naturally with the release’s new Buttons and Social Icons blocks and colour options. For users building their first site under lockdown, it offered a polished starting point without extra plugins.

Plugin of the Month: WooCommerce

WooCommerce 4.0 arrived just as many small retailers were forced to move sales online. Its new admin and onboarding wizard made it easier to set up a store quickly, and its importance grew with every week of lockdown.

Host of the Month: Kinsta

Kinsta’s managed WordPress platform on Google Cloud handled sudden traffic changes with container-based infrastructure. As some sites saw surges and others had to pivot quickly, reliable scaling and staging mattered.

Founder of the Month: Mark Forrester

Mark Forrester co-founded WooThemes, the company that created WooCommerce before it was acquired by Automattic in 2015. WooCommerce 4.0’s release in a month when commerce moved online almost overnight underlined how far the project he helped start had come.

Looking Ahead to April 2020

April should bring early planning for WordPress 5.5, including auto-updates, XML sitemaps and lazy loading, and further Gutenberg releases that build on block patterns. A 5.4.1 maintenance release is likely. WordCamp Europe and WordCamp US are expected to announce how they will adapt, and more community events will move online.

Site owners should also keep an eye on plugin security advisories, since March’s run of disclosures showed attackers moving quickly on newly published flaws.