WordPress News Roundup May 2020: WordPress Turns 17 as WordCamp Spain Goes Online and Elementor Pro Is Attacked

May 2020 showed a community that had learned to work and gather online. WordCamp Spain ran as a virtual event with more than 5,500 attendees, WordPress celebrated its 17th birthday with online meetups around the world, and contributors pressed ahead with patterns and the first pieces of full site editing for WordPress 5.5.

The month was also busy for security teams, with a combined attack on Elementor Pro and a related add-on, a large-scale XSS campaign and a vulnerability in Google’s own WordPress plugin. Here is the full roundup.

Mergers, Acquisitions, and Investments

• Automattic invests in New Vector (May 21): Automattic made a $4.6 million strategic investment in New Vector, the company behind the Matrix open standard for decentralised chat.
• WPDeveloper acquires EmbedPress (May 31): WPDeveloper announced its purchase of the EmbedPress embedding plugin from Steve Burge’s team.

Away from deals, WP Engine launched a Genesis Pro add-on for its customers on May 7, with more features promised.

WordPress Core Updates

• Gutenberg 8.1 (May 13): Made it easier to insert patterns, added a testimonials pattern, and introduced a button for copying a selected block.
• Gutenberg 8.2 (May 27): Introduced pattern categories, a viewportWidth property for large patterns, content positioning for the Cover block and editing flow improvements.
• 5.5 planning: The core team published a 5.5 planning roundup, and contributors set out which editor features, including early full site editing groundwork, would target the release.
• PHP and WordPress checks for themes: A change merged for 5.5 would stop users from installing or activating themes that required a newer PHP or WordPress version than their site ran.
• Release squads: The 2020 release squads were announced on May 29.
• Drag and drop menus: Contributors explored drag and drop for navigation menu items in the new block-based menus work.

Other WordPress News

• WordCamp Spain Online: Held May 6–9, it drew more than 5,500 attendees, 60 speakers and 16 sponsors, with over 200 people joining the online contributor day. Matt Mullenweg took part in a Q&A on virtual events, decoupled WordPress and page builders.
• Happy 17th: WordPress turned 17 on May 27, celebrated with online meetups under the #WP17 hashtag.
• BuddyPress 6.0 “iovine’s”: Released on May 13 with Members and Groups blocks and a completed BP REST API.
• Themes Team rename: The Theme Review Team became the Themes Team, reflecting work well beyond reviews, from full site editing to Twenty Twenty.
• Online WordCamp support: The Community Team published guidelines for online WordCamps and offered to cover production and captioning costs without local sponsorship.
• WooCommerce Payments: WooCommerce launched WooCommerce Payments, letting store owners manage payments without leaving the WordPress admin.
• Block-based cart and checkout: WooCommerce began testing block-based cart and checkout experiences.
• Accessibility Day announced: The accessibility team said it would host a 24-hour online event on October 2, 2020.
• WordCamp Asia 2021: Organisers called for organisers for a January 2021 event.
• Jetpack 8.5: Added a podcast player block.

Security Alerts and Plugin Vulnerabilities

• Elementor Pro and Ultimate Addons: On May 7, Wordfence warned that attackers were combining a zero-day in Elementor Pro with a flaw in Ultimate Addons for Elementor to take over sites. Elementor patched quickly, but around a million sites were at risk.
• Large-scale XSS campaign: Wordfence reported on May 5 that nearly a million WordPress sites were targeted in attacks attempting to exploit old XSS vulnerabilities, much of it traced to a single attacker.
• Google Site Kit: A vulnerability patched in Google’s Site Kit plugin could have let attackers gain owner access to a site’s Search Console property.
• Page Builder by SiteOrigin: CSRF flaws affecting over a million sites were patched on May 11.
• PageLayer: High-severity vulnerabilities affecting more than 200,000 sites were fixed late in the month.
• GoDaddy hosting breach: GoDaddy disclosed that SSH credentials for about 28,000 hosting accounts had been compromised, prompting password resets.

Industry Trends and Insights

• Online events can scale: WordCamp Spain’s numbers showed virtual events could reach far more people than in-person ones, even if they could not replicate the hallway track.
• Page experience in search: Google announced on May 28 that page experience, including Core Web Vitals, would become a ranking signal in 2021, putting performance on every site owner’s agenda.
• Builders as targets: The Elementor attacks showed that the most popular page builders and their add-ons had become high-value targets for attackers.
• Payments inside WordPress: WooCommerce Payments signalled Automattic’s ambition to make WooCommerce a more complete, integrated commerce platform.
• Template marketplaces: Envato launched a marketplace for Elementor template kits on May 14, another sign of how large the page builder economy had grown.

Theme of the Month: eStar

GretaThemes released eStar in late May, a lightweight theme built to work well with the block editor. Its focus on speed and simplicity fitted a month in which Google put page experience firmly on the roadmap.

Plugin of the Month: WooCommerce Payments

WooCommerce Payments let store owners accept cards and manage transactions, disputes and deposits from their WordPress dashboard. With so many small retailers newly selling online, a built-in payments option lowered the setup burden.

Host of the Month: WP Engine

WP Engine spent May strengthening its block tooling, building on the Block Lab team it had hired in April and launching Genesis Pro for its customers. It was a clear sign that the host saw block-based site building as central to its offering.

Founder of the Month: Mike Little

Mike Little co-founded WordPress with Matt Mullenweg in 2003, when they forked b2/cafelog. In the month WordPress turned 17, it was worth remembering that a single comment offering to help maintain a fork became software powering more than a third of the web.

Looking Ahead to June 2020

June begins with WordCamp Europe 2020 Online on June 4–6. WordPress 5.4.2 is expected, alongside further Gutenberg releases and decisions on which features make WordPress 5.5, including XML sitemaps. WordCamp Denver and other regional events are also moving online.