7 Nov 2024

The Various Rationales Put Forward by Matt Mullenweg and His Lawyers for His Action Against WP Engine’s ACF

When Matt Mullenweg announced a takeover of WP Engine’s Advanced Custom Fields (ACF) on October 12, he cited the guidelines of the WordPress Plugin Directory for doing that:

On behalf of the WordPress security team, I am announcing that we are invoking point 18 of the plugin directory guidelines

Those guidelines are one of the things you need to agree to submit plugins to the directory.

Ten days later, lawyers representing Matt Mullenweg claimed that WP Engine had no agreement with WordPress.org and “no terms, conditions, or permissions that entitle them to such access” to things like the plugin directory:

Mr. Mullenweg has no contracts, agreements, or obligation to provide WP Engine access to the network and resources of WordPress.org. WP Engine points to no terms, conditions, or permissions that entitle them to such access.

It’s hard to square citing the guidelines as a reason to take an action and they say nothing like that exists. WP Engine’s lawyers disagree with that second position.

Matt Mullenweg put forward a different position in between those two explanations. On October 20, he published a very confused explanation of the First Amendment of the US Constitution and free speech on his website. At one point he claimed that “The First Amendment is the basis of our democracy.” WordPress notable is a dictatorship and not a democracy. He went on to claim that “The First Amendment says I should be able to state facts and my opinions about WP Engine.” It actually doesn’t say that. He then wrote:

However, the New York Times is not required or compelled to publish them in their newspaper and distribute them to their subscribers.

WP Engine is free to publish whatever GPL code they want to the world. WordPress.org should not be compelled to distribute it or provide it free hosting.

WordPress.org offers to provide free hosting to anyone, though. WP Engine’s lawsuit that filed on October 2 had this to say about free hosting:

On that developer website, WordPress promises that “wordpress.org offers free hosting to anyone who wishes to develop a plugin in our directory.” The wordpress.org website is a control point over distribution or WordPress plugins. Nowhere on the developer website does it say that a developer must pay money to WordPress to host their plugins on wordpress.org, or that access to wordpress.org can be blocked at Mullenweg’s whim. Nor does wordpress.org disclose on the site that it is not owned and operated by the nonprofit WordPress Foundation (despite the dot-org top level domain and WordPress Foundation donation page), but is, in fact, owned and controlled solely by Mullenweg.

(The WordPress website referenced there can be found here.)

On October 30, his lawyers in another legal filing cited the previously mentioned guidelines in justifying the takeover:

The forked SCF plugin was deployed as an update to ACF to address the existing associated vulnerability and per the Website Plugin Guidelines.


Plugin Security Scorecard Grade for Advanced Custom Fields

Checked on March 19, 2025
C+

See issues causing the plugin to get less than A+ grade

Leave a Reply

Your email address will not be published.