WordPress News Roundup November 2014: WordPress 4.0.1 Fixes a Critical XSS Flaw as Automattic Buys Code for the People

November 2014 combined a critical security release with steady progress toward the year’s final version. WordPress 4.0.1 fixed a cross-site scripting flaw that could let anonymous users compromise sites running older versions, and pushed fixes to every supported branch through automatic updates. WordPress 4.1 entered beta with Twenty Fifteen and a reimagined distraction-free writing mode.

Automattic expanded its enterprise team in Europe, WooCommerce held its first conference, and WP Engine bet on HHVM for faster PHP.

Mergers, Acquisitions, and Investments

• Automattic acquires Code for the People: On November 6, announced at Web Summit in Dublin, Automattic acquired UK agency Code for the People. Its small team, led by Simon Dickson and Simon Wheatley, joined WordPress.com VIP to strengthen its presence in Europe, and the agency brand was retired. Developer John Blackbourn joined Automattic and continued as 4.1 release lead.
• CyberChimps seeks investors: Theme company CyberChimps said it was looking for outside investment.
• Crowdfunding core work: John James Jacoby launched an Indiegogo campaign on November 11 to fund full-time work on BuddyPress, bbPress and GlotPress.

WordPress Core Updates

• Focus approved: On November 12 the Focus project’s redesigned distraction-free writing and a session management UI were approved for merge into 4.1.
• WordPress 4.1 Beta 1 (November 14): Beta 1 featured Twenty Fifteen, the new distraction-free writing mode, installing language packs from General Settings and an inline toolbar for images. Developers could test complex nested meta, date, comment and taxonomy queries, the splitting of shared taxonomy terms, theme support for title tags and Customizer API improvements.
• WordPress 4.0.1 (November 20): This critical security release fixed a cross-site scripting vulnerability in WordPress 3.9.2 and earlier, reported by Jouko Pynnönen, that could enable anonymous users to compromise a site. For 4.0 it fixed eight issues, including three XSS issues usable by contributors or authors, a CSRF issue, a denial-of-service risk in password checking, further server-side request forgery protections and an extremely unlikely hash collision. It also fixed 23 bugs, and older branches received 3.9.3, 3.8.5 and 3.7.5.
• Cleaning up admin screens: 4.1 was set to remove the separate custom background and header screens in favour of the Customizer.

Other WordPress News

• WooConf: The first conference dedicated to WooCommerce took place in San Francisco in early November with more than 300 attendees. The night before, WooCommerce passed 5 million downloads.
• WP Engine and 10up launch Mercury: On November 20 WP Engine launched Mercury, an enterprise platform running HHVM with automatic fallback to PHP, built with 10up, which reported large performance gains.
• Five for the Future pledges: WebDevStudios and Human Made publicly committed 5% of their time to contributing to WordPress.
• Automattic’s DMCA process: Automattic open-sourced its DMCA process documentation on GitHub.
• Emoji on WordPress.com: WordPress.com added emoji support, with Jetpack to follow.
• LoopConf controversy: LoopConf’s $800 ticket price sparked debate about the cost of WordPress developer events.
• Jetpack 3.2 and centralised posting: Jetpack sites could now be written to from the WordPress.com editor, part of Automattic’s push to manage self-hosted sites from one place.
• Slack integrations: New plugins sent WordPress and bbPress events to Slack channels, an early sign of teams wiring their sites into chat tools.

Security Alerts and Plugin Vulnerabilities

• The 4.0.1 XSS flaw: The anonymous XSS issue fixed in 4.0.1 did not affect 4.0 itself, but it was serious for sites on older versions. Automatic background updates delivered fixes to all supported branches within hours.
• Bad plugin practices exposed: Some plugins broke after 4.0.1 because they relied on behaviour the security fixes changed, a reminder to use core APIs properly.
• Two-factor for installers: Installatron partnered with Clef to add two-step authentication to automated WordPress installs.

Industry Trends and Insights

• DigitalOcean’s rise: Netcraft ranked DigitalOcean the third-largest hosting provider, and the company said it hosted 13,000 active one-click WordPress droplets.
• Performance arms race: HHVM, built by Facebook, became a selling point for high-end WordPress hosting.
• Enterprise WordPress in Europe: The Code for the People deal showed Automattic investing in enterprise clients beyond the US.

Plugin of the Month: Shortcake

Shortcake, a new open-source project, offered a visual interface for adding and editing shortcodes. It tackled one of the editor’s most confusing features, and the idea would later be explored as a feature plugin for core.

Host of the Month: DigitalOcean

In under two years DigitalOcean grew to become the world’s third-largest hosting provider by Netcraft’s count. Its inexpensive SSD servers and one-click WordPress images made it a favourite with developers comfortable managing their own stacks.

Founder of the Month: Mark Forrester

Mark Forrester, co-founder of WooThemes, delivered the State of the Woo at the first WooConf. With WooCommerce past 5 million downloads, the event marked its emergence as an ecosystem large enough for its own conference.

Looking Ahead to December 2014

WordPress 4.1 is planned for mid-December after release candidates. WordSesh 3 is set for December 20, and John James Jacoby’s BuddyPress, bbPress and GlotPress campaign continues.