14 Jan 2025

Matt Mullenweg Will Again Be “Community Member” Ultimately Responsible for WordPress Release With Version 6.8

Recently the head of WordPress, Matt Mullenweg, was complaining about the time and energy he was having to expend on the project. If this wasn’t performative, you would reasonably expect that he would hand off work to others. One place that could happen is with the Release Lead role for next release of WordPress. That role is supposed to be the “community member ultimately responsible for” a release of WordPress. But in reality, going back through the last 15 releases, he had that role 12 times. Two employees of his company, Automattic, handled the other two. On Friday afternoon, though, it was announced that he again would be taking on that role.

From a security perspective, having a new release lead would be an opportunity for someone who might allow known security issues with WordPress and fairly easy to implement security improvements to finally be implemented. That unfortunately hasn’t been of interest to Matt Mullenweg and those other Automattic employees. Hopefully, not because of the business interest in Automattic selling security solutions. [Read more]

3 Jan 2025

Matt Mullenweg’s Lawyers Claim WordPress News Blog Posts “Lack the Characteristics of Typical Fact-Based Documents”

Once you log in to the backend of a WordPress website, one of the things you then you see by default is a widget showing the latest WordPress “News.” What you actually get is very different. Late last year, you would have seen a promotion for the WordPress.com service:

[Read more]

20 Dec 2024

Matt Mullenweg Finally Claims on WordPress.org That He Owns It, While Making False Claims About Volunteers and His Legal Problems

Since Matt Mullenweg started trying to extort WP Engine, the issue of who owns and controls the website for WordPress, WordPress.org, has come up again and again. Curiously, Matt Mullenweg has claimed in various locations that he personally owns and controls it, while not disclosing on the website. For example, on September 25 he wrote on the News blog on the website that “What I will tell you is that, pending their legal claims and litigation against WordPress.org,” that was despite there being no legal action threatened against WordPress.org (but was threatened against him). By comparison, in an October 4 story from The Verge, he claimed “WordPress.org just belongs to me personally.” That changed in a post today on the News blog of the WordPress website where he stated “but also me individually as the owner of WordPress.org.”

The About page of the website still reads as if the website is for the WordPress project, instead of his personal website as he claims elsewhere. [Read more]

13 Dec 2024

WPScan Ignores That Security Issue From Website of Their Boss, Matt Mullenweg, Played Vital Role in WordPress Websites Being Hacked

Two days ago, a news story about WordPress websites being hacked was published titled “Hunk Companion WordPress plugin exploited to install vulnerable plugins.” The last part of that is important, but was largely ignored in the story. With the only mention saying that “While investigating a WordPress site infection, WPScan discovered active exploitation of CVE-2024-11972 to install a vulnerable version of WP Query Console.” That plugin was closed on the WordPress Plugin Directory on October 21.

[Read more]

12 Dec 2024

Matt Mullenweg Claims WordPress is Meritocracy Where Ideas Can Be Debated While Banning People Who Disagree With Him

In a post yesterday, we covered that those in charge of WordPress didn’t know how people could appeal being banned from WordPress. That came during a question and answer stream with the new Executive Director of WordPress.org, who wasn’t selected by the community, but is instead was hired by Matt Mullenweg’s company Automattic to have that role. Similarly, the previous person in that role (under the title Executive Director of WordPress) was an Automattic employee in charge of their team that was involved in WordPress. The new Executive Director had so little involvement with WordPress before being named to the role that her account on the website was created the same day she was announced for the role.  Matt Mullenweg didn’t acknowledge their employment with Automattic when announcing them in that role. WordPress is far from a meritocracy.

In a recent article on the “culture of fear” inside WordPress, the banning of community members was mentioned several times, including in this paragraph: [Read more]

10 Dec 2024

Matt Mullenweg Shuts Down Conversation on Addressing His Employees Abusive Behavior Towards WordPress Community

Recently the new Executive of WordPress.org Mary Hubbard did a question and answer Zoom stream with Matt Mullenweg. WordPress focused news outlets covered this in a rather unquestioning way (no surprise, considering the general lack of journalism from them). Watching it, a question and the lack of an answer stood out that wasn’t covered by those news outlets. Mary Hubbard read this question (at the 30 minute mark of the stream):

I would love to see WordPress and A8C [Automattic] make a move towards more professional communication. Those are rough edges, like Otto and Felipe that sometimes come off as too aggressive of community members. Do you plan on recruiting volunteers with communication experience? [Read more]

6 Dec 2024

Matt Mullenweg Signed WordPress Foundation Trademark Application as “CEO”, Despite Not Being Its CEO

Former direct employee of Matt Mullenweg, Samuel Sidler, wrote an interesting post about the unclear ownership of the Openverse, which is a WordPress project. One piece of the story ties into something we have looked at. The extent that the WordPress Foundation is intertwined with Automattic, especially with trademark applications. He wrote this:

The application of the wordmark was made by the WordPress Foundation, with Mullenweg signing the paperwork with a title of “CEO.”[9] Meanwhile, on the trademark application for the logo, Mullenweg signed the paperwork with a title of “Founder.” On November 10, 2022, Chloe Bringmann—with a title of “Chief of Staff”—signed a “statement of use” for the logo, noting first use was July 20, 2021. Bringmann signed a “statement of use” for the wordmark on May 23, 2023, noting first use was April 27, 2021. [Read more]

7 Nov 2024

The Various Rationales Put Forward by Matt Mullenweg and His Lawyers for His Action Against WP Engine’s ACF

When Matt Mullenweg announced a takeover of WP Engine’s Advanced Custom Fields (ACF) on October 12, he cited the guidelines of the WordPress Plugin Directory for doing that:

On behalf of the WordPress security team, I am announcing that we are invoking point 18 of the plugin directory guidelines [Read more]

5 Nov 2024

Matt Mullenweg’s 18+ Month Timeline of Interactions About “Trademark Abuse” With WP Engine Keeps Shrinking

As time has gone on, a central element of Matt Mullenweg’s story of how he got to publicly attacking WP Engine has continued to crumble. That is the timeline of meetings between the two sides over a deal to address what he now claims is trademark abuse. In a post dated October 14, on his own website, he claimed, as he has elsewhere, this was going on for 18+ months, ‘Automattic did not work on a deal with WP Engine for 18+ months because of the GPL, or them using “WP” in their name, it was because of their abuse of the WordPress and WooCommerce trademarks.’ But looking at another of his statements and something from the company he runs, Automattic, suggests there would have to be a much shorter timeline.

On October 1, Automattic put forward a 20 month timeline of meetings between the two sides. Here the first three items on that: [Read more]

4 Nov 2024

Matt Mullenweg Now Says That the Contribution Option of His Extortion Demand Was Added Because He Thought He Would Be Exposed

In late September, when WP Engine originally exposed through a cease and desist letter that Matt Mullenweg attacks on them was part of an extortion campaign against them, he almost immediately admitted to the extortion demand on Reddit. It was an odd response. But his defense seemed to be that he wasn’t just asking for money to be paid to his for-profit company, Automattic. He always provided the option to donate employee time to WordPress, “They had the option to license the WordPress trademark for 8% of their revenue, which could be delivered either as payments, people (Five for the Future .org commitments), or any combination of the above.” It turned out that the option to donate time came with some serious caveats, including that the donated time would be spent on work apparently at his personal direction:

Commit 8% of its revenue in the form of salaries of WP Engine employees working on WordPress
core features and functionality to be directed by WordPress.org. WP Engine will provide Automattic
a detailed monthly report demonstrating its fulfillment of this commitment. WordPress.org and
Automattic will have full audit rights, including access to employee records and time-tracking [Read more]