WordPress News Roundup October 2019: WordPress 5.2.4 Security Release and the WordPress 5.3 Release Candidates

October 2019 was a month of final preparation. WordPress 5.3 moved from its last beta into three release candidates, with a November 12 launch date and a new default theme, Twenty Twenty, ready to go. Along the way, WordPress 5.2.4 shipped on October 14 to close six security issues, and three new core committers were appointed.

It was also a month of change at some well-known WordPress businesses, from a founder stepping back at StudioPress to a new chief financial officer at Automattic, while the community looked ahead to WordCamp US in St. Louis at the start of November.

Mergers, Acquisitions, and Investments

• MachoThemes buys gallery plugins (October 10): The parent company of the Modula gallery plugin acquired three further gallery plugins, consolidating its position in a crowded category.
• ExpressionEngine changes hands: The open source CMS ExpressionEngine came under new ownership, with a commitment to remain open source for the time being.
• Automattic hires a CFO: Mark Davies joined Automattic as Chief Financial Officer in mid-October.
• GoDaddy and WooCommerce: GoDaddy launched an eCommerce hosting plan built in partnership with WooCommerce on October 24.

WordPress Core Updates

• WordPress 5.3 Beta 3 (October 8): The final beta continued testing of the release’s editor, admin and image changes.
• WordPress 5.2.4 (October 14): A short-cycle security release fixing six issues, including stored XSS via the Customizer and in style tags, a way to view unauthenticated posts, cache poisoning of JSON GET requests, a server-side request forgery in URL validation, and referrer validation problems in the admin. Fixes were backported to older branches.
• Release candidates: RC1 arrived on October 15, RC2 on October 22 and RC3 on October 29, with release scheduled for November 12.
• What 5.3 brings: The release includes admin CSS changes to improve accessibility and consistency, big image handling that scales down oversized uploads, more reliable date and time handling, preparation for PHP 7.4, and the Twenty Twenty theme. The 5.3 Field Guide was published on October 17.
• New committers: Ian Belanger, Timothy Jacobs and Joe Dolson were given commit access, with Ian’s focused on bundled themes and Timothy and Joe receiving full core access.
• Gutenberg 6.7: Released in late October, it introduced gradient backgrounds and a Storybook for editor components.

Other WordPress News

• Brian Gardner leaves StudioPress: On October 1, the creator of the Genesis Framework announced he was stepping down from StudioPress, a year and a half after its sale to WP Engine.
• Digital Citizenship Week: WordPress.org ran a series of posts during Digital Citizenship Week on how open source can help people of all ages participate online safely and responsibly.
• Newspack’s first site: Chilean outlet El Soberano became the first publication to launch on Newspack.
• Featured themes plan: The Theme Review Team began planning a curated list of featured themes for the Theme Directory and revived its review “shindigs.”
• Mullenweg and DHH: Matt Mullenweg and Basecamp’s David Heinemeier Hansson debated market share, monopolies and power in open source.
• Meetup pricing: When Meetup.com tested RSVP fees for members, WordPress meetup groups were confirmed as unaffected by the change.
• WordCamp Asia tickets: The first WordCamp Asia announced its next batch of ticket sales for November 1.
• Accessibility team reps: The Accessibility Team began electing representatives for 2020.
• People of WordPress: The monthly series featured Alice Orrù from Sardinia.

Security Alerts and Plugin Vulnerabilities

• WordPress 5.2.4: The core release was the month’s most important update. In November, the team added credit to Simon Scannell of RIPS Technologies for a further fix in 5.2.4, a path traversal issue that could lead to remote code execution.
• Fast Velocity Minify: On October 16, Wordfence reported a medium-severity vulnerability patched in the Fast Velocity Minify optimisation plugin.
• Bridge theme: An open redirect vulnerability was patched in the popular commercial Bridge theme on October 21.
• SyntaxHighlighter Evolved: A stored XSS flaw was fixed in the SyntaxHighlighter Evolved plugin on October 22.
• Accessibility and the law: On October 7, the US Supreme Court declined to hear Domino’s appeal in a website accessibility case, leaving in place a ruling that websites can be covered by the Americans with Disabilities Act.

Industry Trends and Insights

• Accessibility moves centre stage: Between 5.3’s admin styling changes and the Domino’s decision, accessibility was becoming both a design priority and a legal consideration for businesses.
• HTTPS everywhere, really: Google announced a phased plan to block mixed content in Chrome starting around the turn of the year, putting pressure on sites that still loaded images or scripts over HTTP.
• PHP 7.4 on the horizon: With PHP 7.4 due in late November, developers explored features such as typed properties and the spread operator, and 5.3 prepared core for compatibility.
• Hosting meets commerce: GoDaddy’s WooCommerce plan showed hosts packaging ecommerce more aggressively as small businesses moved online.

Theme of the Month: Chaplin

Anders Norén’s Chaplin was the free theme that Twenty Twenty was built from. Its bold typography, flexible templates and close integration with the block editor made it a natural pick in the month its offspring became WordPress’s next default theme.

Plugin of the Month: Modula

Modula, the gallery plugin at the centre of MachoThemes’ October acquisitions, offered a custom grid, lightbox and image optimisation options in a free core. Its owners’ decision to buy competing gallery plugins showed how valuable this category remained.

Host of the Month: GoDaddy

GoDaddy launched a WooCommerce-powered eCommerce hosting plan in October and showcased its managed WordPress onboarding process. For first-time store owners, combining hosting and WooCommerce setup lowered the barrier to selling online.

Founder of the Month: Jason Schuller

Jason Schuller, the designer behind Press75 and Leeflets, launched DSKO at the end of October, a discovery network for creators and brands. He has spent years experimenting with simpler publishing tools at the edges of WordPress, and DSKO continued that thread.

Looking Ahead to November 2019

November opens with WordCamp US in St. Louis on November 1–3, including Matt Mullenweg’s State of the Word. WordPress 5.3 is scheduled for release on November 12 with Twenty Twenty as its default theme, and PHP 7.4 is due at the end of the month. The annual WordPress survey is also expected to open.