WordPress News Roundup May 2015: WordPress 4.2.2 Release, Automattic Acquires WooThemes and WooCommerce

May 2015 produced the biggest deal the WordPress world had seen. On May 19, Automattic announced that WooThemes, the company behind WooCommerce, was joining it, putting the most popular e-commerce plugin on WordPress under the same roof as WordPress.com, Jetpack and Akismet.

The month opened with a security release that fixed a flaw in an icon font bundled with Twenty Fifteen and Jetpack, and closed with WordPress’ 12th birthday on May 27. In between, WordPress.org experimented with localised directories and the Theme Review Team tightened its rules.

Mergers, Acquisitions, and Investments

• Automattic acquires WooThemes: Announced on May 19, the deal brought WooCommerce, Sensei and the rest of the WooThemes catalogue to Automattic, along with 55 team members in 16 countries. In his announcement, Matt Mullenweg said WooCommerce had passed 7.5 million downloads and more than a million active installs, and cited BuiltWith data showing it ahead of Magento among the top million sites. The price was not disclosed, though Re/code reported speculation of more than $30 million in cash and stock.
• Hummingbird Web Solutions acquires CyberChimps (May 5): The Pune-based firm took over CyberChimps’ WordPress themes, plugins and services, and founder Trent Lapinski stepped down.
• Madison Dearborn invests in Liquid Web (May 27): The private equity firm made a growth investment in Liquid Web, with Jim Geiger replacing founder Matthew Hill as CEO.
• Crowdfunding a host: Dan Griffiths launched a $175,000 crowdfunding campaign to build HostPress, part of a year in which several crowdfunded WordPress projects struggled to reach their targets.

WordPress Core Updates

• WordPress 4.2.2: Released on May 7, this security and maintenance release removed a vulnerable example HTML file from the Genericons icon font package, reported by Robert Abela of Netsparker, and actively scanned wp-content to remove copies bundled in themes and plugins. It also fixed a critical cross-site scripting issue reported by Rice Adu and Tong Shi of Baidu X-Team, hardened the visual editor, and fixed 13 bugs.
• 4.3 takes shape: Under release lead Konstantin Obenland, contributors pushed feature plugins including the Menu Customizer towards a merge decision, with better passwords and Customizer improvements also on the agenda.
• Customizer documentation: The Theme Developer Handbook gained a comprehensive guide to the Customizer API, supporting April’s new requirement that WordPress.org themes use it for options.
• Localised directories: WordPress.org began testing international versions of the theme and plugin directories, an early step towards language-specific browsing.

Other WordPress News

• WordPress turns 12: The software celebrated its 12th birthday on May 27, with Matt Mullenweg joining the WP Weekly podcast to mark the occasion.
• Theme review crackdown: The Theme Review Team began enforcing its presentation-versus-functionality guideline more strictly, pushing features such as custom post types out of themes and into plugins.
• WordPress.com theme marketplace: WordPress.com suspended theme submissions from new sellers on May 1.
• Automattic’s new theme: Automattic released Gazette, a free magazine theme, on May 11.
• Hosting tools: WP Engine began beta testing WP-CLI support with select partners, while WP Tavern reported that cPanel’s Site Software add-on was disabling WordPress automatic updates.
• BuddyPress 2.3 beta: The first beta arrived on May 7, introducing companion stylesheets for the default themes and the new BP Attachments API for avatar uploads.
• Events: WordCamp Belgrade sold out its first edition, LoopConf published all of its sessions on YouTube, and WordCamp Miami prepared to livestream its tracks at the end of the month.
• Products: WP Rollback launched to let users roll plugins and themes from WordPress.org back to earlier versions, and the TGM Plugin Activation library published a roadmap for version 3.0.

Security Alerts and Plugin Vulnerabilities

• Genericons DOM XSS: The flaw fixed in 4.2.2 sat in an example file shipped with Genericons, which was bundled in Jetpack and the Twenty Fifteen default theme, so it potentially affected millions of sites. Jetpack issued its own update in parallel.
• Critical core XSS: The second issue in 4.2.2 could let anonymous users compromise a site running 4.2 or earlier.
• Security education: The Hello Security plugin launched with the aim of teaching WordPress users web security best practices, and Sucuri revealed it was building a website firewall and CDN to compete with CloudFlare.

Industry Trends and Insights

The WooThemes deal reframed WordPress as a commerce platform as much as a publishing one. Matt Mullenweg’s post put WordPress at roughly 23% of the web and estimated around 650,000 WooCommerce storefronts, and with Automattic now backing the plugin directly, competitors such as Magento and hosted platforms such as Shopify faced a WordPress ecosystem with real resources behind its store software.

The deal also raised questions that would echo for years: how independent WooCommerce extension developers would fare, and how much of WordPress’ commercial ecosystem Automattic should own. On the wider web, a WordPress veteran’s report from DrupalCon Los Angeles offered a look at how the two big open-source CMS communities were evolving in parallel.

Theme of the Month: Gazette

Gazette, released by Automattic on May 11, was a free magazine-style theme built for news and content-heavy sites. It showed how a clean, editorial layout could be delivered within the WordPress.org rules on keeping functionality out of themes.

Plugin of the Month: WooCommerce

There was no other choice for May. With more than a million active installs and a new owner in Automattic, WooCommerce became the centre of gravity for e-commerce on WordPress. The acquisition guaranteed long-term investment in the plugin and set the stage for it to become the most widely used store software on the web.

Host of the Month: WP Engine

Fresh from its $23 million raise in March, WP Engine began rolling out WP-CLI support to select partners in May. Command-line access was a long-standing request from developers, and offering it on a managed platform marked a shift towards serving agencies with more technical workflows.

Founder of the Month: Mark Forrester

Mark Forrester co-founded WooThemes in 2008 with Adii Pienaar and Magnus Jepson, building it from a theme shop into the company behind WordPress’ leading store plugin. The Automattic deal in May was the culmination of that journey, and one of the largest exits the WordPress product world had seen.

Looking Ahead to June 2015

June was set to bring the final release of BuddyPress 2.3, a merge decision on the Menu Customizer for WordPress 4.3, and WordCamp Europe in Seville from June 26 to 28, where the host city for 2016 was expected to be announced. Automattic was also approaching its 10th anniversary.