WordPress News May 2019: WordPress 5.2 Launch, Security Alerts, and Industry Shifts

May 2019 was a landmark month for WordPress. WordPress 5.2 shipped with the Site Health tool and PHP fatal error protection, two features the community had been waiting for since the block editor launched in December 2018.

Security closed out the month on a sharp note with two critical plugin vulnerabilities disclosed in the final days. Meanwhile, the commercial side of the ecosystem was beginning to consolidate in ways that would define the market for years ahead.

Mergers, Acquisitions, and Investments

May 2019 was quiet on the deal front. No major mergers, acquisitions, or investment announcements were confirmed in the WordPress ecosystem during the month.

WordPress Core Updates

May 2019 was a big month for WordPress core. Two releases shipped within three weeks of each other, delivering new tools, bug fixes, and a meaningful step forward in platform stability.

• WordPress 5.2 “Jaco” Released on May 7: The Site Health tool landed, giving site owners a clear view of their PHP version, active plugins, and configuration issues. PHP fatal error protection replaced the white screen of death with an admin email alert and a recoverable dashboard. A batch of block editor improvements from months of Gutenberg development also made it into core.

• WordPress 5.2.1 Released on May 21: A maintenance release addressing 34 bugs reported after the 5.2 launch. Fixes covered the media library, REST API, and block editor performance. Sites were encouraged to update immediately.

Other WordPress News

May was defined by the WordPress 5.2 launch and an active community season, with WordCamps running and the block editor debate still very much alive.

• WordPress 5.2 Launch Reaction: The Site Health tool and PHP error protection in 5.2 were widely welcomed by the developer community. Agency owners and hosting companies saw the Site Health screen as a practical way to help non-technical users understand and fix site configuration issues without developer involvement.

• Classic Editor Still Growing: The Classic Editor plugin continued climbing past 3 million active installs through May. The numbers reflected how many site owners were still holding off on Gutenberg adoption five months after WordPress 5.0 shipped the block editor.

• Gutenberg Plugin Updates Continue: The Gutenberg plugin maintained its biweekly release cadence through May, with each update feeding improvements back into core. Full site editing remained a topic of active discussion on Make WordPress Core as the long-term direction of the block editor became clearer.

• WordCamp Detroit on May 18: The event took place at Detroit Shipping Co., bringing together the local WordPress community for a one-day conference covering development, design, and business topics.

• WordCamp Europe 2019 Approaching: The community was actively preparing for WordCamp Europe in Berlin, set for June 20 to 22. Contributor Day teams published their focus areas in May, with the Core PHP Team, Gutenberg Documentation Team, and Accessibility Team all announcing their plans ahead of the event.

• PHP Version Awareness Push: Following the 5.2 release, hosting companies and the WordPress community ramped up messaging around PHP version upgrades. With 5.2 setting a minimum of PHP 5.6.2 and strongly recommending PHP 7.3, May saw a coordinated push to move the ecosystem toward modern PHP.

Security Alerts and Plugin Vulnerabilities

May 2019 ended with two significant plugin disclosures in the final days of the month, alongside ongoing active exploits across the ecosystem.

• WP Database Backup OS Command Injection: A command injection flaw was disclosed on May 28, affecting over 70,000 sites. An attacker could inject OS commands that are executed every time the plugin runs a backup. The flaw was patched in version 5.2.

• Convert Plus Critical Vulnerability: A critical, unauthenticated flaw allowing the creation of administrators was disclosed on May 30, scoring a perfect 10.0 on the CVSS. An attacker could create a full admin account without any login credentials. Patched in version 3.4.3.

• Three Severe Plugin Vulnerabilities: Three plugins carrying severe vulnerabilities affecting over 150,000 installations combined were publicly disclosed on May 29. Two had patches available at the time of disclosure, one did not.

• WP Cost Estimation Attacks Ongoing: Active exploitation of outdated versions of the WP Cost Estimation and Payment Forms Builder plugin continued through May, following the original disclosure in January 2019. Sites that had not updated remained exposed.

• Brute Force Activity Steady: Consistent brute force login traffic targeting wp-login.php continued through May. Unprotected admin accounts remained the most common entry point for attackers across the ecosystem.

Industry Trends and Insights

May 2019 reflected a WordPress ecosystem in transition. The block editor was reshaping how developers and agencies thought about building sites, while the commercial side of the market was beginning to consolidate in ways that would define the next several years.

• Gutenberg Was Dividing the market into two: Developers and agencies were splitting into two camps, those adapting to the block editor and those actively avoiding it. The Classic Editor plugin’s growth past 3 million installs was a clear signal that a large portion of the market was not ready to move and was not being forced to.

• Hosting Companies Were Moving Up the Stack: The acquisition activity from GoDaddy and the approaching WP Engine and Flywheel deal pointed to a clear strategic shift. Hosting providers were moving beyond infrastructure and building full product ecosystems by acquiring plugins, themes, and developer tools.

• Managed WordPress Hosting Was Growing Fast: Flywheel, WP Engine, Kinsta, and Pressidium were all expanding. Site owners and agencies were moving away from shared hosting toward managed WordPress environments that handled updates, security, and performance out of the box.

• WooCommerce Driving Commercial Adoption: eCommerce on WordPress was growing steadily in 2019. WooCommerce was the default choice for online stores built on WordPress, and its flexibility was attracting small and mid-sized businesses setting up online for the first time.

• Plugin Security Getting More Attention: Two critical plugin disclosures in the final days of May alone highlighted a growing awareness problem. The ecosystem had tens of thousands of plugins with no standardized security review process, and the gap between disclosure and patching posed a real risk to site owners.

• WordPress Powered 33% of the Web: WordPress powered approximately 33% of all websites globally as of 2019 and held around 60% of the CMS market. Joomla and Drupal were declining steadily while Shopify and Wix were growing from a small base, setting up the competitive shift that would reshape the market through the 2020s.

Theme of the Month: Breakdance

Breakdance is a visual website builder for WordPress that launched as a standalone product after its creator, Soflyy, and the team behind WP All Import identified a market gap for a faster, more developer-friendly page builder. It works as a theme replacement, giving users full control over headers, footers, and templates without needing a separate theme.

Built for speed and flexibility, Breakdance generates clean code output and ships with a library of pre-built templates and components. It quickly gained traction among developers and agencies seeking a modern alternative to Elementor with less bloat and greater control over the final output.

Plugin of the Month: Complianz

Complianz is a cookie consent and privacy compliance plugin built for WordPress. It automatically scans a site for cookies, generates region-specific consent banners, and creates the required privacy and cookie policy pages in accordance with applicable regulations, including GDPR, CCPA, and ePrivacy.

With support for all major cookie consent frameworks and deep compatibility with WooCommerce, caching plugins, and popular page builders, Complianz is one of the most complete compliance solutions available for WordPress. It handles the legal complexity so site owners can focus on running their business.

Agency of the Month: Seahawk Media

Seahawk Media is a full-service WordPress agency offering development, design, maintenance, security, and white-label services for businesses and agencies worldwide. Their team handles everything from custom builds and WooCommerce development to hacked site repair and ongoing site care.

For agencies looking to scale without growing their internal team, Seahawk’s white-label program lets partners resell WordPress services under their own brand. Their broad service range and deep WordPress focus make them a dependable partner for high-volume client work.

Host of the Month: GreenGeeks

GreenGeeks is a web hosting provider focused on environmentally responsible infrastructure. It matches 300% of the energy it consumes with renewable energy credits, making it one of the few hosting companies in the world that gives back more than it takes from the grid.

Beyond its green credentials, GreenGeeks offers managed WordPress hosting with LiteSpeed servers, built-in caching, free CDN, nightly backups, and free site migration. It is a strong option for individuals, small businesses, and agencies seeking reliable WordPress hosting without the environmental costs of traditional infrastructure.

Founder of the Month: Scott Bolinger

Scott Bolinger is the co-founder of AppPresser, a platform that lets WordPress site owners build iOS and Android mobile apps directly from their WordPress installation. He started as a graphic designer, taught himself web development, and launched his first premium WordPress theme company in 2010 before co-founding AppPresser in 2013.

The idea came after hearing Matt Mullenweg speak at WordCamp San Francisco about WordPress moving into the app space. By May 2019, AppPresser had surpassed $1 million in all-time revenue, and Scott had become a regular WordCamp speaker and a recognized voice in the WordPress product business community.

Looking Ahead to June 2019

June brings WordCamp Europe to Berlin from June 20 to 22, where Matt Mullenweg is expected to address the state of Gutenberg and the road ahead for the block editor. It is the biggest community gathering of the first half of the year, and the conversation around Gutenberg’s direction will be front and center.

Plugin security will stay in focus following the back-to-back critical disclosures in late May. With one vulnerability still unpatched at the close of the month, site owners heading into June need to keep their plugin stacks up to date.