The Wordfence Security team has found a security vulnerability in Elegant Themes’s themes Divi and Extra, as well as in the Divi Builder plugin. Elegant Themes writes:

Today Divi, Extra and the Divi Builder plugin were updated to fix a security vulnerability. Updating these themes and plugins to their latest versions will fix the problem and keep your website secure.

The builder lacked sufficient file type checks in the Divi Portability system, allowing for arbitrary file uploads. This is a critical security issue that could allow logged-in contributors, authors and editors with access to the builder to upload disallowed files to the server, leading to further exploit.

Fortunately, the problem looks confined to abuse by existing users, rather than a more general-purpose exploit, but please update Divi (the theme and the plugin) as soon as you can.

Not to pile on, but Divi—and everything else Elegant Themes creates—is fast headed to the absolute bottom of my list of WordPress software quality.

It’s not just this recent problem; before that, I’ve interacted with two clients in only the past month who cannot use major sections of their sites because the Divi Builder is broken in crucial ways. (One person is experiencing 30-second delays on any interaction on the post editing screen, even with Divi disabled; the other can’t change her Divi layouts because trying to delete a Divi row triggers a JavaScript error.) Because these bugs are baked into the page builder, I can’t fix them: I just have to route around them.

Divi obviously makes a big target for security exploits, and kudos to their team for disclosing the vulnerability. But still, please tell a friend to tell a friend to avoid Divi—and, honestly, Elegant Themes altogether.

I really really appreciate this rundown of the major options for setting up a local WordPress development (which is to say—on your own computer) that Ram Ratan Maurya updated for Delicious Brains. I feel like on the whole for those of you new to the concepts involved, I don’t (currently) know of a better place I would point you to get a sense of what the major options are for setting WordPress up on your local computer are, and what their major strengths and weaknesses. (Perhaps we should work on one here… 🤔)

In any case, I’ll add some colorful information about my own choices—mostly I actually use Laravel Valet, for my local WordPress development. That said: I do not recommend anyone *new* to the idea of local development does that. Mostly because it’s more complicated and error-prone then ALL the options that the article talks about. But unlike some of those options, it also works great for Laravel (and Symfony) sites, which I maintain a few of.

I thought of summarizing Ram’s findings here, but I think you can and should just click through and read them over on their site. 🤓

I’m working on a WordPress project that needs custom post types, custom fields, custom taxonomies, and custom taxonomy meta. To do this, I installed three entirely separate plugins: CPT UI, Advanced Custom Fields, and a taxonomy metabox solution that I regret using (its code dates back to before WordPress had taxonomy meta, and uses its own custom data structure).

Too late, I realized I could have used a single plugin to do all this: Pods. I’ve liked and used Pods in the past, but I think I never really got its value proposition as clearly as I did this week.

If you need a one-stop-shop for custom data in WordPress, try out Pods. CPT UI and ACF are both very good, but for my next project that needs lots of types of custom data, Pods is what I’ll start with.

More than a few weeks ago now, my friend Jeremy Green talked at the Fort Collins WordPress Meetup about how to make Gutenberg blocks. One of the struggles he mentioned was the lack of great tutorials on the details of the code — which is pain I’ve also felt in my explorations of making them. One good-looking resource that he recommended (and it took my forever to get to because I’m “busy”) is this YouTube playlist from Alessandro Castellani.

While I still haven’t watched it to completion, I will say that what I have watched has been crisp, clear, and totally worth more than the price of admission. (Which is free, because YouTube 🤪) Give it a look!

I know that this is a WordPress-focused site. But I also know that programming is as central to WordPress as writing. So I thought I’d share this fun little article that simply and clearly lays out the (classic) “Hello world” program in 30 different programming languages. It’s fun to get a quick sense of how much “boilerplate” each language requires, how it chose to say “show on the screen,” etc. And because of the simple format of the post you’ll not be confused about it. Great job to the post’s author Al Muhimen. 🙂

In just about two weeks (depending on when you read this 🤓) the WordCamp that I (David) have been helping to organize for a few years—I actually forget if I helped in 2017 🤷‍♂️—is happening. That is it’s WordCamp Denver 2020 time. Because of that whole bother about COVID, we’re going to be virtual, which does mean that if your area has good time-zone overlap with the US, you can likely attend all or parts of it live. And we’d love to have you!

We’re so grateful for all our speakers, the support from WordCamp Central (which eased getting streaming working quite a lot!), and to the local Colorado folks who’ve attended for years. I should be a fun and interesting time, so please consider grabbing a (virtual) ticket and tuning in.

Aside from the obvious events, we’ve got a few “curve balls” I think should be quite fun, interesting, and distinctive 🤓

I really love this little tour from Iain Poulson at Delicious Brains about the WordPress database. There isn’t a lot in this that I didn’t know or couldn’t guess. That may well be true for you too. But if you don’t feel like you know WordPress’s database well (or even if you do) you can’t really compete with how simple and approachable its whole format it. By simply listing each of the database’s table and explaining what each column does, you can’t read this article and not have *profoundly* deepened your understanding of WordPress’s database and how it works. So please give it a look 🙂

It being the year of COVID (to say nothing of America’s very recent confrontation with our persistent problems with racial injustice) means that WordCamp Europe—now very online and starting tomorrow—had slipped my memory and attention.

If that sounds interesting to you, please at least consider giving it some attention. WordCamp Europe has been one of (or maybe the) most popular WordCamps in recent years. It’s a great gathering of WordPress people from all over, and a real celebration of what the WordPress community is and can be. And at this time in the world, I can certainly use more community celebrations. I’m sure the organizing team will do a fantastic job!

A quick little uplifting story I missed a few weeks ago: as the COVID-19 lockdowns were setting in worldwide, more and more people were doing web searches for “wordpress.” Or so reports Alex Denning, the original creator of WPShout, and a reliable man in my book.

While I could pull more interesting tidbits from Alex’s analysis, I want to encourage you to click through. So I’ll just share this last one:

There has been a ~20% bump in WordPress searches with high purchase intent in the last month.

Another catchy little diddy bankrolled by my friend Zach Katz over at GravityView:

I could put other words here, but they would only demean the importance of this video. 🤓