WordPress News Roundup September 2015: WordPress 4.3.1, a REST API Merge Plan and the Loss of Alex King

September 2015 ended in grief. On September 27, Alex King, founder of Crowd Favorite and one of the earliest developers to work on WordPress, died at home after a long fight with colon cancer. Tributes from across the community recalled how much of WordPress’ early theme culture he had helped create.

Earlier in the month, the project shipped a security release for 4.3 and published its first formal plan to merge the REST API into core, setting up the most technically significant release of the year in WordPress 4.4.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in September. The marketplace story of the month was Envato’s new item support policy for ThemeForest and CodeCanyon, which formalised how long buyers received support and introduced paid extensions, changing the economics for thousands of theme and plugin authors.

WordPress Core Updates

• WordPress 4.3.1: Released on September 15, it fixed three security issues and 26 bugs. Shahar Tal and Netanel Rubin of Check Point reported a cross-site scripting flaw in shortcode processing (CVE-2015-5714) and a privilege escalation that let users publish private posts and make them sticky (CVE-2015-5715). Ben Bidner of the security team reported a cross-site scripting issue in the user list table.
• REST API merge proposal: Ryan McCue published the first official proposal to merge the REST API in two stages: the infrastructure for routing, JSON serialisation, linking and embedding in 4.4, and the content endpoints in 4.5, giving committers an extra cycle to review the more complex part.
• Shortcodes rethink: A proposal to overhaul the Shortcode API, prompted partly by the 4.2.3 breakage, went back to the drawing board after feedback.
• Editor and comment changes for 4.4: Contributors removed the View Post and Get Shortlink buttons from the post editor in 4.4 trunk and discussed rearranging comment form fields.
• Chrome 45 bug: A rendering bug in Chrome 45 broke the WordPress admin menu for many users early in the month, until a fix was made available.

Other WordPress News

• Alex King remembered: King had been part of WordPress from the b2 days, encouraged developers to build themes when WordPress 1.5 introduced its template system, and ran early stylesheet competitions. He had been diagnosed with stage four colon cancer in January 2013.
• WordCamp US tickets: Tickets for the first WordCamp US in Philadelphia went on sale on September 11.
• Yablon settlement: The WordPress Foundation and Jeff Yablon settled their trademark dispute out of court on September 21.
• Jetpack 3.7: Released on September 10, it introduced a simpler interface and support for development sites.
• Matt on Product Hunt: Matt Mullenweg answered community questions in a Product Hunt Q&A session.
• India and HeroPress: Topher DeRosia, who had crowdfunded his trip, recapped WordCamp Pune, and WP Tavern reported on the impact HeroPress was having on Indian WordPress communities.
• WPCampus: The higher-education conference announced in August renamed itself from WordCampus to WPCampus.
• bbPress survey: Results from the 2015 bbPress user survey showed users wanted attachments and better moderation tools.

Security Alerts and Plugin Vulnerabilities

• Core fixes in 4.3.1: The Check Point findings were the month’s headline vulnerabilities, and automatic background updates delivered the fix to most sites quickly.
• WPML password resets: WPML reset customer passwords and emailed the new ones in plain text, prompting fears of a breach. The company confirmed there had been no breach and described the reset as a preventive step, while acknowledging plain-text emails were poor practice.
• WP Super Cache 1.4.5: Patched a cross-site scripting vulnerability on September 25.

Industry Trends and Insights

The REST API merge plan was the clearest statement yet that WordPress intended to become an application platform as well as a CMS. Staging the merge across two releases reflected caution about locking in an API that millions of sites and countless apps would rely on for years.

The commercial side of WordPress was maturing in parallel. Envato’s support policy acknowledged that support was a real cost that needed to be priced, and WP Tavern’s look inside the home offices of 16 people working with WordPress every day captured how normal full-time WordPress careers, many of them remote, had become.

Theme of the Month: Divi

As Envato changed its support rules, Elegant Themes’ Divi stood as the best-known alternative to the ThemeForest model: a theme with a built-in visual page builder, sold through a membership that included every product. Its success showed how page-building had become central to commercial WordPress themes.

Plugin of the Month: Postmatic

Postmatic, which let readers subscribe to posts and reply to comments entirely by email, was featured on WP Weekly in September. At a time when commenting was moving to social networks, it offered a way to keep conversations on WordPress sites themselves.

Host of the Month: Kinsta

Kinsta, a managed WordPress host founded in 2013, was one of the younger companies competing in the premium hosting segment in 2015. Its focus on performance and hands-on support for business sites put it among the specialised hosts that would grow rapidly over the following years.

Founder of the Month: Alex King

Alex King founded Crowd Favorite, one of the first agencies built around WordPress, and authored many early themes and plugins. His CSS style switcher and theme competitions helped create the culture of WordPress theming, and his death in September was a loss felt across the community he had helped build.

Looking Ahead to October 2015

October was expected to bring a decision on merging the REST API infrastructure and the first WordPress 4.4 beta, with responsive images and post embeds among the features in contention. The Kim Parsell Memorial Scholarship recipient was also due to be announced ahead of WordCamp US.