An increasingly bitter clash between two of the largest players in the WordPress ecosystem has gone nuclear after Matt Mullenweg, CEO of Automattic, “forked” and took control over a widely used plugin called Advanced Custom Fields (ACF) that is maintained by rival WP Engine.
ACF has over two million active installations. Supporters of the move say it was necessary to “protect its security” (i.e. deliver fixes and patches effectively) after WP Engine’s ban in September 2024 from WordPress.org infrastructure amid an escalating legal clash between the two companies.
But WP Engine raged in response this weekend that “a plugin under active development has never been unilaterally and forcibly taken away from its creator without consent in the 21 year history of WordPress" and critics say that the "nuclear" move was far more than a simple fork of the code.
“bro wtf are you doing” was the short reaction of Microsoft’s VP of Developer Community, Scott Hanselmann to Mullenweg’s move – and at least one core Wordpress developer promptly quit the project: Scott Kinglsey-Clark posted on Github this weekend that he was “officially terminating my core contributions and involvement with the WordPress project… it greatly pains me to just stop here. I am done making excuses for Matt's actions and will not associate myself with core any longer.”
WordPress Wars: ACF Fork not a legitimate move?
Making a fork of a project and then maintaining and developing it separately is an accepted move in the open-source software (OSS) world.
The official WordPress social media channel on X posted that the move to assert control over ACF was “in line with the guidelines you agreed to by being in the directory” (these say that WordPress can “make changes to a plugin, without developer consent, in the interest of public safety.”)
But critics of the move say Wordpress.org/Mullenweg didn’t just fork the code of the ACF – a popular plugin for WordPress developers, comprising over 200,000 lines of code and created to allow “full control of custom content with fields, post types, and taxonomies” that joined WP Engine in 2022 when it bought a series of widely used tools from Delicious Brains.
His team took over 1) ACF’s slug or identifier on Wordpress.org; 2) the 2+ million installations live and 3) even customer reviews on Wordpress.org. Mullenweg also rolled out the move on a Saturday night with an auto-update that switched sites to the forked ACF version automatically.
This even reportedly broke some sites in the wild.
As the ACF team put it: “The change to our published distribution, and under our ‘slug’ which uniquely identifies the ACF plugin and code that our users trust in the WordPress.org plugin repository, is inconsistent with open source values and principles. The change… is maliciously being used to update millions of existing installations of ACF with code that is unapproved and untrusted by the Advanced Custom Fields team.”
“There’s no going back from this and everything else you have done to destroy the WordPress community. You stole someone’s intellectual property and violated both gpl and your own rules. This isn’t a fork this is a takeover plane [sic] and simple and has no precedent” was one reaction on X that seemed to capture the majority of views on the “nuclear” move.
Many suggested that no plugin developer would trust working with WordPress ever again. (For those new to this world, Wordpress.org is owned by an independent non-profit set up by Mullenweg to host the open-source WordPress project; Wordpress.com is owned by Automattic.)
So why would Mullenweg trigger such a nuclear takeover if it was going to engender such astonishing levels of incredulity and developer rage?
Join peers following The Stack on LinkedIn
There’s history here. (First, here’s Mullenweg in his own words on the move to merge the ACF with a “new plugin, Secure Custom Fields. SCF… updated to remove commercial upsells and fix a security problem.")
The move comes after an escalating legal clash between Automattic and WP Engine (the latter part-owned by investment firm Silver Lake) tidily captured by CNBC's Ari Levy in a early October article here.
Mullenweg had sent a cease-and-desist letter to WP Engine on September 23, alleging years of trademark violations: “In short, WP Engine is violating WordPress’ trademarks” he alleged in a personal blog. “We at Automattic have been attempting to make a licensing deal with them for a very long time, and all they have done is string us along… We offered WP Engine the option of how to pay their fair share: either pay a direct licensing fee, or make in-kind contributions to the open source project” he wrote.
“ This isn’t a money grab: it’s an expectation that any business making hundreds of millions of dollars off of an open source project ought to give back, and if they don’t, then they can’t use its trademarks,” he wrote on September 26, before making the move to take over the ACF plugin.
“WP Engine has refused to do either, and has instead taken to casting aspersions on my attempt to make a fair deal with them. WordPress is licensed under the GPL; respect for copyright and IP like trademarks is core to the GPL and our conception of what open source means. If WP Engine wants to find another open source project with a more permissive license and no trademarks, they are free to do so; if they want to benefit from the WordPress community, then they need to respect WordPress trademark and IP” he said, writing separately: "Why should WordPress.org provide... services to WP Engine for free, given their attacks on us? WP Engine is free to offer their hacked up, bastardized simulacra of WordPress’s GPL code to their customers, and they can experience WordPress as WP Engine envisions it, with them getting all of the profits and providing all of the services."
WP Engine has counter-sued, claiming that "recent actions have exposed and highlighted his long history of obfuscating the true facts about his control and manipulation of the WordPress Foundation and wordpress.org—which he presents as a not-for-profit “dot-org” enterprise, but which in fact he solely owns and directs with an iron fist to further his own commercial interests in Automattic and associated commercial businesses."
Whatever the community's views on the broader clash, with this week’s move Mullenweg likely just blew any potential goodwill from developers out of the water, possibly with severe lasting impact and many are suggesting that a serious fork of WordPress itself is now in order; a major undertaking given the latter's gravitational pull.
What are your views on this escalating situation? Let us know.
