WordPress News Roundup September 2020: WordPress 5.5.1 Release, Twenty Twenty-One Unveiled as the File Manager Zero-Day Hits 700,000 Sites

September 2020 began with a scramble. On September 1, as WordPress 5.5.1 fixed bugs left over from the big August release, Wordfence warned that a zero-day in the File Manager plugin was being exploited on a large scale. The flaw, in a plugin installed on around 700,000 sites, became one of the most widely attacked vulnerabilities of the year.

The rest of the month looked forward. Twenty Twenty-One was announced as the default theme for WordPress 5.6, Gutenberg reached version 9.0, and two notable acquisitions reshaped the membership and WooCommerce extension markets. Matt Mullenweg’s comments on Jamstack, meanwhile, sparked one of the year’s liveliest debates.

Mergers, Acquisitions, and Investments

• iThemes acquires Restrict Content Pro (September 1): iThemes entered the membership plugin market by buying Restrict Content Pro from Sandhills Development.
• GoDaddy acquires SkyVerge (September 14): GoDaddy bought SkyVerge, the developer of more than 60 WooCommerce extensions, strengthening its commerce offering.

WordPress Core Updates

• WordPress 5.5.1 (September 1): A maintenance release with 34 bug fixes, 5 enhancements and 5 block editor fixes, including a backfill for JavaScript globals that 5.5 had deprecated.
• Twenty Twenty-One announced: On September 23, the core team introduced Twenty Twenty-One, a calm, blank-canvas theme for the block editor with a pastel green background and system fonts, building on Automattic’s Seedlet theme.
• Gutenberg 8.9, 9.0 and 9.1: Gutenberg 8.9 brought block-based widgets out of the experimental stage, 9.0 on September 16 refreshed the navigation screen with drag and drop and improved the Query block, and 9.1 followed on September 30.
• Dual licensing proposal: Mobile engineers proposed dual licensing Gutenberg under GPL v2.0 and MPL v2.0 so non-WordPress projects could use it more easily.
• oEmbed changes: Because Facebook and Instagram were deprecating their oEmbed endpoints, core planned to remove those providers, with breakage across the web expected from October 24.

Other WordPress News

• Mullenweg and Jamstack: Comments by Matt Mullenweg questioning Jamstack as an architecture prompted strong responses from that community, and he later clarified his remarks.
• W3C picks Craft: The W3C dropped WordPress from consideration for its website redesign, citing accessibility concerns with the block editor, and selected Craft CMS.
• Theme Directory delisting: The Themes Team added a delist status to temporarily hide themes that break guidelines.
• Web fonts loader: The Themes Team released a web fonts loader for hosting fonts locally rather than through third-party CDNs.
• Plugin update confirmations: Plugin authors could now opt in to confirm releases by email, a safeguard against compromised accounts.
• Busiest month for online WordCamps: Seven online WordCamps took place, from Ogijima and Colombia to São Paulo and Philadelphia.
• Support forum changes: The Support Team discussed letting users archive their own topics and curbing support requests for commercial products.
• Translation week: Polyglots and Marketing teams prepared to celebrate International Translation Day from September 28 to October 4.
• Google Web Stories: Google officially released its Web Stories for WordPress plugin on September 24.
• Jetpack 9.0 preview: Jetpack previewed a feature for publishing posts to Twitter as threads.
• AMP plugin 2.0: The official AMP plugin reached version 2.0 on September 10 with an onboarding wizard and an expanded Reader mode.
• Jetpack 8.9: Released on September 1 with a Donations block, a newsletter form and social previews.
• A Stack Exchange milestone: Fuxia Scholz became the first person to pass 100,000 reputation points on WordPress Stack Exchange.

Security Alerts and Plugin Vulnerabilities

• File Manager zero-day: On September 1, Wordfence reported that an unauthenticated file upload flaw in File Manager, installed on about 700,000 sites, was being actively exploited to upload malicious code. A patched version was released the same day.
• Mass attacks follow: By September 4, millions of sites had been probed, and on September 10 Wordfence described attackers fighting each other for control of compromised sites.
• XCloner Backup and Restore: Critical vulnerabilities were patched on September 22.
• Discount Rules for WooCommerce: High-severity vulnerabilities were fixed on September 17.
• Why sites are hacked: Wordfence published research on what attackers do with compromised sites, from spam to further attacks.

Industry Trends and Insights

• Architecture debates: The Jamstack discussion highlighted competing views of the web’s future, between dynamic CMS platforms and pre-rendered sites.
• Accessibility scrutiny: The W3C’s decision was a reminder that the block editor’s accessibility record still affected WordPress’s reputation with institutions.
• Branch names change: GitHub announced that new repositories would default to “main” rather than “master” from October.
• Commerce consolidation: GoDaddy’s purchase of SkyVerge showed hosts buying WooCommerce expertise as online selling grew during the pandemic.

Theme of the Month: Seedlet

Seedlet, Automattic’s block-first theme, was the foundation chosen for Twenty Twenty-One. Its simple, typographic design and close fit with block editor styles made it a good preview of where default themes were going.

Plugin of the Month: Web Stories

Google’s Web Stories for WordPress plugin left beta on September 24, giving publishers a visual editor for creating tappable, full-screen stories using AMP. It offered WordPress sites a new format that could appear in Google Search and Discover.

Host of the Month: GoDaddy

GoDaddy’s purchase of SkyVerge in September brought a large catalogue of WooCommerce extensions and an experienced commerce team in-house, adding depth to its managed WordPress and WooCommerce hosting.

Founder of the Month: Pippin Williamson

Pippin Williamson founded Sandhills Development, the company behind Easy Digital Downloads, AffiliateWP and Restrict Content Pro. Selling Restrict Content Pro to iThemes in September let Sandhills concentrate on its other products, and gave the membership plugin new ownership.

Looking Ahead to October 2020

The first WordPress 5.6 beta is scheduled for October 20, with Twenty Twenty-One development under way on GitHub. WP Accessibility Day runs online on October 2, and Facebook and Instagram embeds are expected to break on October 24 when their old oEmbed endpoints are retired. Further 5.5 maintenance releases are possible.

Hacktoberfest also returns on October 1, the same day GitHub begins defaulting new repositories to a “main” branch.