Product2 publishers3 min readPublished
The board vote that sidelined Mullenweg left WordPress.org's patch pipeline in his hands
Automattic's directors put Matt Mullenweg on paid leave and handed the CEO job to their CFO. The plugin directory and the trademark that WordPress sites depend on are still his, held personally outside the company.
The Product Desk · Product desk
What happened
- Automattic's board placed founder and CEO Matt Mullenweg on a paid leave of absence over his objections and made finance chief Mark Davies interim CEO.
- Mullenweg says the board gave him 50 minutes' notice of the meeting and not enough time to seek legal counsel, and he named Davies, Ann Dunwoody, Toni Schneider and Sue Decker in a company-wide Slack message.
- He voted against the move, was outvoted, and remains a member of Automattic's board.
- WordPress.org executive director Mary Hubbard wrote that Mullenweg remains the leader of the WordPress project and that teams, priorities and work continue as planned.
- The board acted while Mullenweg's fight with WP Engine, whose access to WordPress.org patches, plugins and security updates he cut off, is still in court.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure A WordPress customer's patch supply answers to a person outside the reach of its contract. Brue still files this as vendor risk after the leadership change.
- decision Diligence and renewal questions now have to go to two addresses, because one entity sells hosting while another ships updates and licenses the name.
- constraint Teams hoping the change unlocks roadmap money get stabilisation and compliance work instead, on Brue's reading of the CFO appointment.
- contradiction The two published readings point different ways: the WordPress project says its work continues as planned, while Brue infers exposure severe enough that the board dropped fairness and optics to move fast.
The security update that lands on an enterprise WordPress site comes from the plugin and theme directory at WordPress.org. Mullenweg owns and controls that directory personally, along with the WordPress trademark, according to Frank Dickson, principal analyst at Dickson Research [3][4]. "The part of WordPress that actually keeps enterprise IT up at night isn't Automattic's org chart," Dickson said [3]. The board, in his account, "changed who runs its hosting business without changing who controls the distribution pipeline millions of those hosted sites still depend on" [4].
Of the three dependencies Dickson names, the hosting operator, the update directory and the trademark, the vote moved one [22].
Automattic's emailed statement to Computerworld said that "Matt Mullenweg is currently on leave from Automattic," that Davies "will lead the company as interim CEO," and that the board "has full confidence in Mark's leadership" [5].
A vendor file on WordPress risk usually puts the contract and the support terms with Automattic. In production the code arrives from a directory Automattic does not own [4], and WordPress.com, Automattic's own product, runs on WordPress.org too [10].
The precedent is already on a docket. Mullenweg denied WP Engine access to WordPress.org resources, including patches, plugins and security updates [11]. That litigation continues after a series of rulings in WP Engine's favour [12]. "I would still treat this as vendor risk, because WordPress.org is still controlled by Matt, separate from Automattic," said Melody Brue, analyst-in-residence at Moor Insights & Strategy, who has tracked WordPress for years [13].
Every deployment has two names attached, the party that bills you and the party that ships you code. Where the second name is WordPress.org, this week left your risk register exactly as it was, and the trademark you use in your own marketing belongs to the same individual it did last month [4]. Where the second name is a host that mirrors or stages updates for you, the useful question is what that mirror does on the day directory access stops. WP Engine has already run that test [11].
Brue read the speed as a signal about the board rather than the product. She said the CFO's appointment "definitely shows some stabilization and possibly some legal compliance cleanup," and added, "What it doesn't say is renewed product investment" [15].
Mullenweg, still a director, posted on X that he needs to hire sysadmins and security researchers quickly and that no applicant may come from Automattic. In the same post he said he supports Davies as interim CEO, then added: "But I think it's probably good if I move some of my stuff currently hosted there, elsewhere" [17]. Neither Automattic nor Mullenweg told Computerworld whether the board's next steps involve his control of WordPress.org [19].
What to watch
- Whether any settlement between the board and Mullenweg moves WordPress.org or the WordPress trademark inside Automattic.
- The next rulings in the WP Engine litigation, and any change to who can pull from the WordPress.org directory.
- Whether Automattic puts an end date on the leave or makes Mark Davies permanent CEO.