2024 WordPress Recap: A Lot More Happened Than Just #WPDrama

WordPress began last year with a very athletic 6.5 “Regina” release. I deliberately chose that adjective because the improvements over 6.4 could best be compared to Olympic racing – the Post Editor and Site Editor became twice as fast, while input processing speed increased up to five times. And for international users, loading times for translated sites jumped up to 25% faster. On a non-athletic-but-still-appreciated note, AVIF image support was added. ¹

The introduction of the Font Library system increased the depth of the WordPress design bench to the tune of 288 pages worth of new fonts – courtesy of the new Google Fonts integration inside the Full Site Editor. This was a massive win for not only WordPress, but block themes specifically.

This democratization of design continued through the 6.6 “Dorsey” release. We got the ability to create color sets and font sets and then pair them in combinations across one theme. Another big win was that you could now make content changes in each instance of a synced pattern while maintaining a consistent style across them. These changes could be applied to Heading, Paragraph, Button, and Image blocks inside of synced patterns.

Dorsey also introduced the automatic rollback feature for failed plugin auto-updates – something I personally appreciated. ²

By November, WordPress 6.7 “Rollins” arrived, which included the launching of the annual WordPress theme – in this case Twenty Twenty-Five. HEIC image support was also introduced and lots more design controls were added – particularly for border controls across a wide array of block types. ³

In terms of security, 2024 began in the shadow of a December 2023 vulnerability that spilled over into January. Attackers exploited a security flaw in the Popup Builder plugin, which allowed them to create unauthorized admin accounts through cross-site scripting. And with an admin account, they could take over an entire site. Both Sucuri and Wordfence became aware of the attack and helped protect their users against it. ^{4 5}

By June, things escalated dramatically when a sophisticated supply chain attack targeted WordPress.org’s plugin repository, compromising five popular plugins including Social Warfare. ⁶ The attackers injected malicious code that could create unauthorized admin accounts (sound familiar?) and inject SEO spam. This supply chain attack pattern would prove to be a recurring nightmare, with three more plugins falling victim to it in October. ⁷

The summer months revealed vulnerabilities in some of WordPress’s heavyweight plugins. WPML, with over a million installations, disclosed a serious authentication bypass vulnerability in June. ⁸ In August, LiteSpeed Cache (a plugin with over five million users) patched a critical privilege escalation vulnerability that could allow complete site takeovers. ⁹

But October proved to be most overwhelming month for WordPress security. Multiple high-profile incidents made headlines:

• Over 6,000 sites fell victim to an infostealer attack through more than 20 compromised plugins. ¹⁰
• Jetpack, one of WordPress’s most popular plugins, discovered a critical vulnerability affecting versions dating back to 2016. Luckily, there was no evidence that it had been exploited. ¹¹
• WPForms revealed an issue that affected over six million sites and could have led to unauthorized payment refunds if it hadn’t been caught. ¹²
• Really Simple Security’s authentication bypass vulnerability put over four million sites at risk. ¹³

Syed Balkhi of Awesome Motive continued with his aggressive expansion strategy. In February, under his Growth Fund umbrella, he acquired Beacon (a lead magnet creation platform) and brought it under the OptinMonster brand. ¹⁵

Syed’s shopping spree continued in April, with AccessAlly joining his portfolio company Caseproof (which already included MemberPress and Pretty Links). This further consolidated his position in the membership platform market. ¹⁶

June brought interesting developments to the Contact Form 7 ecosystem, with our acquisition of a sister product related to the main plugin. The Redirection for Contact Form 7 plugin automates post-submission workflow management, solving common pain points for form users. It’s been a valuable addition to our existing plugin offerings and we’re excited to continue working on it in 2025. ¹⁷

The following month, WP Engine made waves by acquiring NitroPack, bringing advanced site speed optimization tools to over 219,000 websites. ¹⁸ WP Engine’s move signaled a growing emphasis on Core Web Vitals and user experience in the WordPress hosting space.

Also in July, Syed acquired BuddyBoss, a move that strengthened his presence in the community and learning platform space. ¹⁹

As the year drew to a close, companies were still strategically expanding their plugin portfolios – that included us. In November, we purchased the WP Full Pay plugin and swiftly integrated it into our plugin family. We thought it was a strong alternative to WP Simple Pay and we are going to enhance its functionality even further this year.

To wrap up 2024, in early December, Automattic made perhaps the year’s most forward-looking move by acquiring WPAI. ²⁰ Known for its AI-powered WordPress tools like CodeWP and AgentWP, WPAI’s consolidation into the Automattic brand signaled both a strategic business decision and an acknowledgment of AI’s growing importance in the WordPress ecosystem.

As we kick off 2025, the WordPress community finds itself at a critical juncture. Matt’s December 20th announcement of WordPress.org’s partial shutdown ²² left many people feeling uneasy.