WordPress News Roundup May 2017: WordPress 4.7.5 Release, WordPress Joins HackerOne as 4.8 Reaches Release Candidate

May 2017 was a month of security housekeeping and release preparation. The WordPress security team launched an official bug bounty program on HackerOne, WordPress 4.7.5 fixed six vulnerabilities, and WordPress 4.8 went from first beta to release candidate in less than two weeks, with a June 8 launch in its sights.

At the same time, a conversation began that would shape the next two years of WordPress development: core contributors started formally discussing which JavaScript framework to adopt, and by the end of the month the debate had narrowed to React versus Vue.

Mergers, Acquisitions, and Investments

• Weglot raises seed funding: The French team behind the Weglot multilingual plugin closed a €450,000 seed round, a rare venture investment in a WordPress-first product at the time.
• Rainmaker Digital and Nimble Worldwide: Rainmaker Digital, the company behind StudioPress and the Rainmaker Platform, announced a partnership with Nimble Worldwide late in the month.

WordPress Core Updates

• WordPress 4.8 Beta 1: Released May 13 for what was described as a smaller release. Highlights included an updated TinyMCE with better handling of links and other inline elements, a revamped dashboard news widget showing nearby WordPress events, and new media widgets.
• Beta 2 and RC: Beta 2 followed on May 23 and the release candidate on May 25, with the team targeting Thursday, June 8 for the final release.
• Admin improvements: 4.8 also widened the maximum width of the Customizer sidebar to 600 pixels on large screens and improved accessibility on admin screens, including cleaner headings for screen reader users.
• WordPress 4.7.5: Released May 16, it fixed six security issues and three maintenance bugs (details below).
• HHVM dropped from testing: Core removed HHVM from its automated testing infrastructure, a sign that PHP 7 had won the performance argument.
• JavaScript framework debate: Contributors began discussing which framework WordPress should adopt for future interfaces, including the new editor. React and Vue emerged as the front-runners by the end of May.

Other WordPress News

• WordPress.com and plugins: WordPress.com began experimenting with allowing Business plan customers to install third-party plugins and themes, a significant shift for a platform that had always restricted them.
• WordPress.com on TV: Automattic’s television commercials for WordPress.com were airing in the US, and many viewers found the messaging confusing.
• WordCamp Europe: The Paris event neared a sell-out and announced that regular ticket sales would close on May 31. Organizers also reported that some attendees were being refused visas because the ticket price seemed too low to justify the trip.
• Community formats: The Community team considered a new retreat-style WordCamp format, and Cape Town scheduled its fourth do_action charity hackathon for July 15.
• Mental health: WP Elevation dedicated its May content to mental health, and the WPHugs community launched to raise awareness in the WordPress world.
• Product releases: Storefront 2.2.0 refreshed WooCommerce’s default theme, Jetpack 4.9 added an EU cookie law banner widget, and WP-CLI 1.2.0 arrived with a new logo.
• WooConf 2017: WooCommerce announced that its developer-focused conference would be held in Seattle in October.

Security Alerts and Plugin Vulnerabilities

• WordPress on HackerOne: On May 15, the security team announced that WordPress was officially on HackerOne, with bounties for valid reports against core, WordPress.org infrastructure and related projects. The announcement noted that WordPress powered more than 28% of the top ten million sites.
• WordPress 4.7.5: The release fixed insufficient redirect validation in the HTTP class, two XML-RPC issues with post meta, a CSRF flaw in the filesystem credentials dialog, XSS when uploading very large files, and an XSS issue in the Customizer. Reporters included Ronni Skansing, Sam Thomas and Yorick Koster.
• Password reset disclosure: In early May, researcher Dawid Golunski published details of an unpatched issue in which a spoofed Host header could cause password reset emails to be sent with an attacker’s domain in the From and Return-Path headers. The security team said exploitation depended on server misconfiguration and that a fix would come in a future release.
• Avada patch: The best-selling Avada theme released version 5.1.5 to fix stored XSS and CSRF vulnerabilities.

Industry Trends and Insights

• WannaCry: The global ransomware outbreak on May 12 did not target WordPress, but it put patching discipline at the top of every IT agenda and strengthened the case for automatic updates.
• RSS revival: JSON Feed launched as a modern alternative to RSS, aiming to make syndication easier for developers and to revive interest in the open web.
• GPL in court: A US district court denied a motion to dismiss a GPL infringement case, a ruling followed closely by open source developers because it treated the license as an enforceable contract.
• The JavaScript shift: The framework debate showed that WordPress’s future interface would be written in modern JavaScript, a change with big implications for theme and plugin developers.

Theme of the Month: Storefront

Storefront 2.2.0 brought a design refresh and major improvements to the new user experience for WooCommerce’s official free theme. With WooCommerce 3.0 still bedding in, a lightweight theme built and tested by the WooCommerce team was the safest starting point for new stores.

Plugin of the Month: Weglot

Weglot’s seed round made it one of the few WordPress plugins backed by venture funding in 2017. Its approach, automatic translation with human editing handled in the cloud, offered an alternative to traditional multilingual plugins and showed investors could see value in the WordPress plugin market.

Host of the Month: Flywheel

Flywheel had built a loyal following among designers and agencies with its managed WordPress hosting and its free Local development app. As 4.8 testing ramped up, tools like Local made it easy for agencies to try betas on throwaway sites, exactly as the release posts recommended.

Founder of the Month: James Farmer

James Farmer, co-founder and CEO of Incsub, the company behind WPMU DEV and Edublogs, discussed his long career in WordPress business on WP Weekly in May. His companies had been selling WordPress plugins, themes and services since the multisite days, and his perspective on building a sustainable product business remained valuable as the market matured.

Looking Ahead to June 2017

WordPress 4.8 was set for release on June 8. Clef’s two-factor service was due to shut down on June 6, and the Community Summit (June 13–14) and WordCamp Europe in Paris (June 15–17) would bring contributors together in person.

The Gutenberg team was preparing to put its new editor in front of a wider audience, and the JavaScript framework decision was expected to remain one of the hottest topics in core.