WordPress News Roundup May 2016: Automattic Revealed as the Force Behind .blog and WordPress 4.5.2 Patches Plupload

May 2016 brought one of the more surprising reveals in Automattic’s history. On May 12, the company confirmed that a subsidiary, Knock Knock WHOIS There LLC, had won the rights to the .blog top-level domain in a 2015 auction with a bid of about $19 million, and that it would oversee the domain’s launch later in the year.

The month also brought a security release fixing flaws in two third-party libraries bundled with core, a serious arbitrary file upload vulnerability in one of the most popular form plugins, and a hack at a commercial theme company that held customer credentials. WordPress celebrated its 13th birthday on May 27.

Mergers, Acquisitions, and Investments

• Automattic and .blog: Knock Knock WHOIS There, working with domain company Primer Nivel, had secured .blog through an ICANN-overseen auction in 2015 for roughly $19 million. Automattic laid out a timeline of a sunrise period for trademark holders in August, a landrush in October and general availability in November. The extension opened to registrars on May 18.
• WooCommerce Connect: Automattic introduced WooCommerce Connect, hosted components for e-commerce functions such as shipping, an early sign of how it planned to add services around the free plugin.
• Protecting the Woo brand: Automattic also began enforcing its Woo, WooThemes and WooCommerce trademarks.

WordPress Core Updates

• WordPress 4.5.2: Released on May 6, this security release fixed a vulnerability in Plupload, the third-party upload library, affecting 4.5.1 and earlier, and a reflected cross-site scripting issue in the MediaElement.js player affecting versions 4.2 to 4.5.1. Both were analysed and reported by Mario Heiderich, Masato Kinugawa and Filedescriptor of Cure53.
• ImageMagick concerns: The release post also referred readers to a separate core post on WordPress’ response to the ImageTragick vulnerabilities in ImageMagick that had emerged the same week.
• 4.6 development: WordPress 4.6 would drop Open Sans in the admin in favour of native system fonts, and improve the accessibility of the tag and category management screens.
• Plugin Directory prototypes: The Meta team published prototypes of the redesigned Plugin Directory on May 20.

Other WordPress News

• Recommended hosts revamped: WordPress.org relaunched its recommended hosting page with four companies: Bluehost, DreamHost, Flywheel and SiteGround, with Flywheel and SiteGround appearing for the first time.
• WordCamp Incubator: After receiving 182 applications and narrowing them to 16 communities, the programme picked Indonesia, Zimbabwe and Colombia for its first incubated WordCamps.
• WordCamp Europe livestream: Organisers announced free live streaming for all sessions at the Vienna event.
• Storefront 2.0: WooCommerce released version 2.0 of its Storefront theme with major mobile design improvements.
• Thematic ends: After eight years, the lead developers of the Thematic theme framework discontinued the project.
• Theme review rules: The Theme Review Team voted on new guidelines banning obtrusive upselling in free themes.
• Timber 1.0: The Twig-based Timber library for theme development reached version 1.0 on WordPress.org.
• Automattic themes: Automattic released Affinity, a free wedding theme.
• Events: WordCamp Chicago took place at the turn of the month.

Security Alerts and Plugin Vulnerabilities

• Ninja Forms: Researcher James Golovich responsibly disclosed multiple flaws in Ninja Forms, which ran on more than 500,000 sites. The most serious was an arbitrary file upload allowing remote code execution, mostly in the 3.0 preview code bundled with versions 2.9.36 to 2.9.42. Fixed releases were issued, and Wordfence published its own report.
• Templatic hacked: Commercial theme company Templatic disclosed that an attacker had accessed files and databases containing customer usernames and passwords and demanded a ransom. Payment card data was not exposed. The company told customers to change any credentials they had shared with it and to update products using its Tevolution plugin.
• Jetpack 4.0.3: Patched a critical cross-site scripting vulnerability on May 26.
• bbPress 2.5.9: Fixed a cross-site scripting vulnerability on May 3.
• Developer tools: Critical vulnerabilities were found in the PhpStorm IDE, and developers were advised to update immediately.

Industry Trends and Insights

The .blog news reflected a broader bet on blogging as a brand. Automattic was positioning a new domain extension, distinct from WordPress itself, at the very moment social platforms and newsletters were competing for writers’ attention. It also made Automattic one of the few WordPress companies operating a domain registry.

May’s security stories underlined that WordPress’ attack surface was increasingly in its dependencies and its vendors. Core had to patch third-party JavaScript libraries, ImageMagick flaws affected image processing on servers everywhere, and Templatic’s breach showed the risk of handing hosting credentials to theme vendors for support. On the tools side, GitHub’s move to unlimited private repositories with higher organisation prices prompted GitLab to court unhappy customers.

Theme of the Month: Storefront

Storefront 2.0, released in May, gave WooCommerce’s official free theme a substantially better mobile design. As more shopping moved to phones, the update mattered for the many stores that used Storefront or one of its child themes as their base.

Plugin of the Month: Timber

Timber 1.0 arrived on WordPress.org in May. By letting developers write theme templates in Twig and keep PHP logic separate, it offered a cleaner way to build custom themes and attracted a loyal following among agencies who preferred MVC-style workflows.

Host of the Month: Flywheel

Flywheel appeared on WordPress.org’s recommended hosting page for the first time in May, alongside SiteGround, Bluehost and DreamHost. For a managed host founded in 2012 and focused on designers and agencies, a place on that short list was a significant endorsement.

Founder of the Month: James Laws

James Laws, co-founder of WP Ninjas, the company behind Ninja Forms, faced a serious vulnerability in May in the 3.0 preview code that had been bundled with the 2.9 branch. The quick release of fixes for every affected version, ahead of the major 3.0 launch later in the year, showed a team taking responsibility for a plugin used on more than half a million sites.

Looking Ahead to June 2016

June was set to bring WordCamp Europe in Vienna from June 24 to 26, with every session livestreamed, and the first WordPress 4.6 beta. A merge decision on Shiny Updates and the public beta of the new Plugin Directory were also expected.