Most Irish agencies, ours included, build on WordPress. It is a defensible choice: mature, well understood, and cheap to hand over to a client’s marketing team. The uncomfortable part has always been that the project sits under an unusual governance arrangement, and for years the answer to “what if that becomes a problem” was that it never had. Between 9 and 11 September that stopped being a hypothetical, and the lesson is not the one the headlines carried.
TL;DR
- On 9 September 2026 Automattic’s board placed founder and CEO Matt Mullenweg on paid leave and named CFO Mark Davies interim CEO. By 11 September Mullenweg told staff he was back in control.
- Throughout the standoff, WordPress.org was unaffected. Executive director Mary Hubbard confirmed that “Matt remains the leader of the WordPress project”.
- Your client’s site does not depend on Automattic, the company with a board. It depends on WordPress.org, which is personally held and has no board at all.
- That is not theoretical: in October 2024 the plugin directory reassigned the Advanced Custom Fields slug, and sites with auto-updates on changed plugin vendor overnight with no admin action.
- The fix is not to leave WordPress. It is to stop treating the update server as a download page and start treating it as the live third-party dependency it is.
What actually happened, and what did not
On Wednesday 9 September, Automattic’s board voted to place Mullenweg on a paid leave of absence, with chief financial officer Mark Davies stepping in as interim CEO. Mullenweg then posted in a company Slack channel visible to all employees that he had received the resolution 50 minutes before the meeting began, that he repeatedly asked for time to have it reviewed by independent legal counsel and was refused, and that Davies had “conspired” with directors Ann Dunwoody, Toni Schneider and Sue Decker. Those are his characterisations, made in his own words, and the board has not publicly answered them.
Two days later he posted again to say the board was back in agreement and that he was in control of the company. Automattic has not confirmed it.
All of that is a governance story about a private company, and on its own it is not your problem. Here is the part that is. While the board was removing him from the commercial entity, WordPress.org carried on completely unchanged. Executive director Mary Hubbard told the community that the change did not affect the leadership or direction of the project, that “Matt remains the leader of the WordPress project”, and that teams, priorities and work continued as planned. He remained a director of Automattic and retained control of WordPress.org for the entire episode.
So the one accountability mechanism that exists here, a board of directors with fiduciary duties, reaches the company and stops dead at the open-source project. It removed a chief executive inside a day. It could not have touched the server your sites ask for updates.
The update server is a live dependency, not a download page
Most teams think of WordPress.org the way they think of a vendor’s website: somewhere you went once to download something. It is not. Every WordPress install with automatic updates enabled is in a standing relationship with api.wordpress.org, asking on a schedule whether there is a newer version of each plugin slug it has installed, and installing whatever comes back.
The important detail is that the identity of the code is the slug, not the vendor. Your site does not ask for “the plugin published by this company”. It asks for updates to advanced-custom-fields, and it trusts the directory to decide what that means.
This is on the record. On 12 October 2024, the plugin directory reassigned the Advanced Custom Fields slug, published a fork named Secure Custom Fields under it, and sites running auto-updates switched plugin vendor overnight without an administrator touching anything. The mechanism is the takeaway, and it is not in dispute: anything installed from the directory can be replaced in place by whoever holds the directory. The affected vendor had roughly 48 hours to stand up its own update path.
We have written before that an exit plan hosted on infrastructure someone else controls is not an exit plan. This is the same failure mode, running in production, on a schedule, with nobody watching.
Two layers of governance, and only one has brakes
Automattic is a company. It has a board, outside investors, a CFO, directors with legal duties, and, as of last week, a demonstrated ability to remove its chief executive on a few minutes’ notice. It is a brake, and it works.
WordPress.org is not that. It is personally held, it has no board, no investors and no external process, and the last four days demonstrated the difference more clearly than any argument could. The mechanism that acted on Automattic had no reach into the thing that actually serves your clients’ code.
This is the single-maintainer problem that every competent team already applies to a 200-line npm package, except the dependency here is the distribution channel for a CMS running a large share of the web, and almost nobody has it written down.
There is a court date in your plugin ecosystem
The other live variable is litigation, and it has a calendar entry. On 28 July 2026, WP Engine filed a sanctions motion in the Northern District of California over the preservation of Mullenweg’s WhatsApp, Signal and Telegram messages from July 2024 through 16 March 2026. It asks the court to treat it as conclusively established that such communications existed and are no longer available, and for mandatory adverse inference instructions requiring a jury to presume the missing messages supported WP Engine’s claims.
Automattic’s opposition, filed at 31 pages, argues that WP Engine cannot identify a single missing message, conversation or counterparty, and points to more than 225,000 documents produced and forensic images of five of Mullenweg’s personal devices. Its explanation for the gap is that the iPhone could not be fully imaged until 16 March 2026 because Cellebrite did not yet support iOS 18.4. The hearing is set for 30 September 2026 before Magistrate Judge Ajay Krishnan.
We have no view on who should win, and for planning purposes it does not matter. The point for a technical decision-maker is narrower and harder to dismiss: the direction of a plugin ecosystem you ship on now has hearing dates in it.
What to actually do about it
Not leave WordPress. That advice is usually sold by people with something else to sell, and a migration is a far larger and more certain cost than the risk it claims to remove. Do this instead, most of which is a week of work across a whole client portfolio.
- Turn off automatic updates from the directory, and own the decision yourself. This is the single highest-value change on the list, because it converts a silent vendor substitution into a pull request somebody reads.
- Buy commercial plugins direct from the vendor. Where a plugin has a licence, a changelog and its own update endpoint, use it. You get a contract and a named counterparty instead of a slug.
- Know which of your plugins have one maintainer and which have a company behind them. The bus factor and the governance risk are the same column in the same register.
- Build from a lockfile. If your deployments come from Composer or an equivalent with pinned versions and checksums, a change of slug ownership cannot become a deployment without a human approving a diff.
- Write the answer to “what do we do if WordPress.org stops serving us”. One page, per client. WP Engine needed that answer in 48 hours in 2024 and had to build it under pressure.
- Say it out loud to the client. A dependency you have named, priced and mitigated is professional judgement. The same dependency discovered during an incident is a failure of yours.
The honest position
WordPress remains the right choice for most of the clients we build for, and that is precisely why the dependency deserves naming. The risk is not that the project collapses. It is that a decision affecting the code on your clients’ servers can be taken by one person, at any time, with no process that anyone outside can predict or appeal, and that most agencies have no answer ready because they have never written the question down. Last week supplied the evidence. The people who write governance risk off as drama are the ones who will find out what it means from a client phone call.
If you want a second pair of eyes on a WordPress estate, an update and dependency policy that survives contact with a real release schedule, or a build pipeline where nothing reaches production without a human approving a diff, that is the kind of work our development and DevOps teams do every week. Get in touch.
📷 Photo by Benjamin Child on Unsplash
