WordPress News Roundup September 2014: WordPress 4.0 “Benny” Ships and Matt Mullenweg Proposes Five for the Future

September 2014 delivered WordPress 4.0, a release that the team insisted was “just another number” but which polished media management, embeds and plugin discovery. It was also a rough month for security, with a critical flaw in a slider bundled with more than a thousand themes and a breach at a well-known WordPress company. And at the end of the month, Matt Mullenweg proposed a simple idea about how companies should give back to WordPress that is still discussed today.

Mergers, Acquisitions, and Investments

• Flywheel raises $1.2 million: On September 5, a year after opening to the public, Flywheel announced $1.2 million in seed funding led by Linseed Capital, with participation from the Nebraska Angels, Ludlow Ventures, Lightbank, Hyde Park Venture Partners and Rose Paul Ventures. It also introduced bulk plans for agencies.
• GoDaddy and Media Temple partner with WP101: Both hosts entered a strategic partnership with WP101 to offer WordPress video training.

WordPress Core Updates

• WordPress 4.0 “Benny”: Released on September 4 and named for clarinettist and bandleader Benny Goodman, 4.0 introduced an endless media grid with a details preview, visual previews of embeds in the editor (including YouTube, tweets, CollegeHumor, YouTube playlists and TED talks), an editor that expands with your content while keeping toolbars visible, and a more visual plugin installer with new metrics across more than 30,000 plugins. It was led by Helen Hou-Sandí, with 275 contributors, a new record.
• WordPress 4.1 release lead: At the end of the month John Blackbourn was named release lead for WordPress 4.1.
• Twenty Fifteen first look: Designs for the Twenty Fifteen default theme were shared on September 9, showing a clean, blog-focused, mobile-first design.
• Annual survey: The 2014 WordPress user and developer survey opened on September 10 ahead of WordCamp San Francisco.

Other WordPress News

• Five for the Future: After being asked at WordCamp Europe how companies should contribute, Matt Mullenweg published Five for the Future, suggesting that organisations in the ecosystem dedicate about 5% of their people to working on WordPress. The exact meaning of “5%” was debated, but several agencies soon pledged to take part.
• WordCamp Europe in Sofia: WordCamp Europe ran September 27–29 at Sofia’s National Palace of Culture, with Matt Mullenweg and Om Malik among the speakers and a contributor day that added new theme reviewers.
• Theme Review mentoring: The Theme Review Team launched a mentoring program to bring on more reviewers.
• Pressgram shuts down: John Saddington discontinued the Pressgram photo app a year after launch.
• BuddyPress 2.1 “Patsy”: Released on September 18 with a new mentions interface and other improvements.
• WordPress.com’s first video ad: WordPress.com released its first video advertisement, “Welcome Home”.
• The end of TimThumb: Ben Gillbanks announced he would no longer support TimThumb, the image-resizing script behind many theme vulnerabilities.

Security Alerts and Plugin Vulnerabilities

• Slider Revolution: On September 3 Sucuri publicised a critical vulnerability in Slider Revolution, a CodeCanyon plugin, that let attackers download any file from the server, including wp-config.php. The developers had patched it quietly months earlier without alerting users. Because the plugin was bundled with themes such as Avada, Envato identified more than 1,000 potentially affected themes, many of which could not easily be updated.
• iThemes breach: On September 23 iThemes disclosed an attack on its membership database and reset all customer passwords. Two days later it confirmed it had stored passwords in clear text, prompting sharp criticism.
• ManageWP’s open letter: ManageWP founder Vladimir Prelovac published an open letter on security to the WordPress community.
• Shellshock: The Bash “Shellshock” bug, disclosed late in the month, affected many servers, and plugins appeared to help check whether hosts were vulnerable.

Industry Trends and Insights

• Bundled plugins, hidden risk: Slider Revolution showed how bundling premium plugins in themes could leave users without updates for critical fixes.
• Who maintains WordPress: Five for the Future put a number on a question that had been building since 10up and WP Engine began sponsoring contributors.
• Internet Slowdown: On September 10 many sites, some using WordPress plugins, took part in the Internet Slowdown protest for net neutrality.

Plugin of the Month: OptinMonster

Syed Balkhi spoke this month about the rapid success of OptinMonster, the lead-generation plugin he co-created. Its growth showed how much demand there was for marketing tools aimed at WordPress site owners.

Host of the Month: Flywheel

Flywheel’s seed round and new agency pricing marked a strong first year for the designer-focused host, at a time when customers were watching managed hosts’ support quality closely.

Founder of the Month: Vladimir Prelovac

Vladimir Prelovac used his position as founder of ManageWP, a tool trusted with access to many thousands of sites, to call for better security practices across the WordPress ecosystem in a month when plugin and vendor security failures were front-page news.

Looking Ahead to October 2014

WordCamp San Francisco takes place in late October with Matt’s State of the Word and the 2014 survey results. WordPress 4.1 development begins under John Blackbourn, with Twenty Fifteen expected to land in trunk, and Envato authors continue to push Slider Revolution fixes to their themes.