WP Engine Escalates Legal Battle With Automattic and Mullenweg via @sejournal, @martinibuster

WP Engine escalated its Federal complaint by citing Automattic’s publication of the WP Engine Tracker website as evidence of intent to harm WP Engine and exposing customers to potential cybercrimes. The updated complaint incorporates recent actions by Mullenweg to further strengthen their case.

A spokesperson for WP Engine issued a statement to Search Engine Journal about the WP Engine Tracker website:

“Automattic’s wrongful and reckless publication of customer’s information without their consent underscores why we have moved for a preliminary injunction. WP Engine has requested the immediate takedown of this information and looks forward to the November 26th hearing on the injunction.”

Legal Complaint Amended With More Evidence

WP Engine (WPE) filed a complaint in Federal court seeking a preliminary injunction to prevent Matt Mullenweg and Automattic from continuing actions that harm WPE’s business and their relationships with their customers. That complaint was amended with further details to support their allegations against Mullenweg and Automattic.

The legal complaint begins by stating in general terms what gives rise to their claim:

“This is a case about abuse of power, extortion, and greed.”

It then grows progressively specific by introducing evidence of how Automattic and Mullenweg continue their “bad acts unabated” for the purpose of harming WP Engine (WPE).

The amended claim adds the following, quoting Mullenweg himself:

“Since then, Defendants have continued to escalate their war, unleashing a campaign to steal WPE’s software, customers and employees. Indeed, just days ago, Defendants were unambiguous about their future plans:”

This is the statement Mullenweg made that is quoted in the amended complaint:

“[S]ince this started [with WPE] they’ve had uh, we estimate tens of thousands of customers leave. . . . So, um you know, I think over the next few weeks, they’re actually gonna lose far more than 8% of their business . . . we’re at war with them. We’re . . . going to go brick by brick and take . . . take every single one of their customers . . . if they weren’t around guess what? . . . We’d happily have those customers, and in fact we’re getting a lot of them.”

WP Engine Tracker Site Used As Evidence

Automattic recently created a website on the WordPressEngineTracker.com domain called WP Engine Tracker that encourages WordPress Engine customers to leave, offering links to promotions that offer discounts and promise a smooth transition to other web hosts.

WPE states that the WP Engine Tracker website is part of a campaign to encourage WPE customers to abandon it, writing:

“Defendants also created a webpage at wordpress.org offering “Promotions and Coupons” to convince WPE customers to stop doing business with WPE and switch over to Automattic’s competitor hosting companies like wordpress.com and Pressable; they later added links to other competitors as well.”

The WordPress Engine Tracker website calls attention to the number of sites that have abandoned WP Engine (WPE) since Matt Mullenweg’s September 21st public denunciation of WP Engine and the start of his “nuclear” war against the web host. The amended Federal lawsuit points to the September 21st date listed on that site as additional evidence tying Automattic to a campaign to harm WP Engine’s business.

The legal document explains:

“Just last week, in an apparent effort to brag about how successful they have been in harming WPE, Defendants created a website—www.wordpressenginetracker.com—that “list[s] . . . every domain hosted by @wpengine, which you can see decline every day. 15,080 sites have left already since September 21st.

September 21 was not selected randomly. It is the day after Defendants’ self-proclaimed nuclear war began – an admission that these customer losses were caused by Defendants’ wrongful actions. In this extraordinary attack on WPE and its customers, Defendants included on their disparaging website a downloadable file of ‘all [WPE] sites ready for a new home’—that is, WPE’s customer list, literally inviting others to target and poach WPE’s clients while Defendants’ attacks on WPE continued..”

The purpose of the above allegations are to build as much evidence that lend credence to WP Engine’s claim that Automattic is actively trying to cause harm WP Engine’s business.

WPE Accuses Automattic Of Additional Harms

Another new allegation against Automattic is that the spreadsheet offered for download on the WP Engine Tracker website includes sensitive information that is not publicly available and could cause direct harm to WPE customers.

The amended Federal lawsuit explains:

“Worse, this downloadable file contains private information regarding WPE’s customers’ domain names, including development, test, and pre-production servers—many of which are not intended to be accessed publicly and contain sensitive or private information. Many of these servers are intentionally not indexed or otherwise included in public search results because the servers are not safe, secure or production-ready and not intended to be accessed by the general public.

By disclosing this information to the general public, Defendants put these development, test, and pre-production domains at risk for hacking and unauthorized access.”

WP Engine Tracker Site Part Of A Larger Strategy

WPE’s amended complaint alleges that the WP Engine Tracker site is one part of a larger strategy to cause harm to WP Engine’s business that includes encouraging WPE employees to resign. The legal document adds new information of how the WP Engine Tracker website is just one part of a larger strategy to harm WPE’s business.

The updated document adds the following new allegations as evidence of WPE’s claims:

“Not content with interfering with WPE’s customer relations, Automattic has recently escalated its tactics by actively recruiting hundreds of WPE employees, in an apparent effort to weaken WPE by sowing doubts about the company’s future and enticing WPE’s employees to join Automattic:”

The document includes a screenshot of an email solicitation apparently sent to an employee that encourages them to join Automattic.

Screenshot Of Evidence Presented In Amended Complaint

Escalation Of Federal Complaint

WP Engine’s amended complaint against Mullenweg and Automattic invokes the Sherman Act (prohibiting monopolization to maintain a competitive marketplace), the Lanham Act (governing trademarks, false advertising, and unfair competition), and the Computer Fraud and Abuse Act (addressing unauthorized computer access and cybercrimes). The amendments tie recent actions by Mullenweg and Automattic—such as the creation of the WP Engine Tracker website—directly to their claims, turning Mullenweg’s attacks on WP Engine into evidence.

Read the amended Federal complaint here: (PDF).

Featured Image by Shutterstock/chaiyapruek youprasert

WordPress Security Plugin Vulnerability Endangers 4 Million+ Sites via @sejournal, @martinibuster

A critical vulnerability was discovered in a popular WordPress security plugin with over 4 million installations. The flaw allows attackers to log in as any user, including administrators, and gain full access to their site-level permissions. Assigned a threat score of 9.8 out of 10, it underscores the ease of exploitation and the potential for full site compromise, including malware injection, unauthorized content changes, and attacks on site visitors.

Really Simple Security

Really Simple Security is a WordPress plugin that was developed to improve resistance of WordPress sites against exploits (called security hardening), enable two-factor authentication, detect vulnerabilities and it also generates an SSL certificate. One of the reasons it promotes itself as lightweight is because it’s designed as a modular software that allows users to choose what security enhancements to enable so that (in theory) the processes for disabled capabilities don’t load and slow down the website. It’s a popular trend in WordPress plugins that allows a software to do many things but only do the tasks that a user requires.

The plugin is promoted through affiliate reviews and according to Google AI Overview enjoys highly positive reviews. Over 97% of reviews on the official WordPress repository are rated with five stars, the highest possible rating, with less than 1% rating the plugin as 1 star.

What Went Wrong?

A security flaw in the plugin makes it vulnerable to authentication bypass, which is a flaw that allows an attacker to access areas of a website that require a username and a password without having to provide credentials. The vulnerability specific to Really Simple Security allows an attacker to acquire access of any registered user of the website, including the administrator, simply by knowing the user name.

This is called an Unauthenticated Access Vulnerability, one of most severe kinds of flaws because it is generally easier to exploit than an “authenticated” flaw which requires an attacker to first attain the user name and password of a registered user.

Wordfence explains the exact reason for the vulnerability:

“The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the “Two-Factor Authentication” setting is enabled (disabled by default).

Wordfence blocked 310 attacks targeting this vulnerability in the past 24 hours.”

Recommended Course Of Action:

Wordfence encourages users of the plugin to update to Really Simple Security version 9.1.2 (or higher version).

The Really Simple Security plugin’s changelog responsibly announces the reason for the updated software:

“Changelog
9.1.2
security: authentication bypass”

Read the Wordfence security advisory:

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass

Featured Image by Shutterstock/Tithi Luadthong

WordPress 6.7 Released – This Is Why It’s A Winner via @sejournal, @martinibuster

WordPress has released version 6.7, codenamed Rollins. This update introduces better font controls, a new default theme, enhanced design tools for easier page creation, 65 accessibility improvements, and performance optimizations. Version 6.7 focuses on making it easy to build attractive, high-performance websites.

Twenty Twenty-Five Theme

Twenty Twenty-Five is the new default theme that ships with WordPress. Twenty Twenty-Five was purpose intentionally built to offer users an easier and more intuitive experience for creating websites.

The official WordPress Twenty Twenty-Five documentation explains:

“While ideating Twenty Twenty-Five, one recurring idea was that simple things should be intuitive while complex things should be possible. This concept of simplicity and complexity leads to a reliable foundation for extending a default WordPress experience to make it yours.

Twenty Twenty-Five embodies ultimate flexibility and adaptability, showcasing the many ways WordPress enables people to tell their stories with many patterns and styles to choose from.”

The key improvements are:

• Better Patterns
  WordPress patterns are pre-designed ready to use blocks for different parts of a page. This allows users to choose from pre-made sections of a web page like the header, call-to-actions, pricing tables and on. Twenty Twenty-Five ships with a wide range of patterns that are appropriate for different kinds of sites.
• Improved Styles
  Better support for fonts in multiple languages plus bundled color variations.

New Templates
There are three base templates that can serve as a starting point for creating a website.

The new template versions are:

• Personal Blog (Default)
  The Personal Blog template is focused on simplicity and ease of use.
• Photo Blog (Alternative)
  This template has multiple layouts that are suitable for image heavy sites.
• Complex Blog (Alternative)
  This template is intended for complex websites, offering more design flexibility.

Typography

As part of the emphasis on a better design experience, WordPress 6.7 features better font management that allows users to more control over fonts.

The WordPress announcement explains:

“Create, edit, remove, and apply font size presets with the next addition to the Styles interface. Override theme defaults or create your own custom font size, complete with fluid typography for responsive font scaling.”

New Zoom Out Feature

WordPress 6.7 has a new design feature that lets users zoom out from the details and see what the site looks like as a whole so that users can swap out block patterns and see what it looks like in macro view. This is in keeping with the focus on making it easy to design attractive websites.

Accessibility Improvements

The documentation for WordPress 6.7 was not as organized as it usually is, making it difficult to navigate to the documentation for the 65 improvements to accessibility are. WordPress documentation is usually better but it seems less organized this time.

This is what the announcement said about the accessibility improvements:

“65+ accessibility fixes and enhancements focus on foundational aspects of the WordPress experience, from improving user interface components and keyboard navigation in the Editor, to an accessible heading on WordPress login screens and clearer labeling throughout.”

Performance Updates

The latest version of the WordPress core ships with faster pattern loading and better PHP 8+ support. Old code (deprecated) is removed to create a more lightweight theme, plus a new auto size component that improves lazy-loading images.

That last improvement to lazy loading should help improve core web vitals scores because the Auto Sizes feature helps the browser select the right image size from the CSS and use that to build the web page, rather than using the image size itself. CSS is usually downloaded before images, so having to depend on image size is redundant and slower. Chrome shipped with this ability last year, December 2023.

Engineering lead at Google Chrome Addy Osmani tweeted about it last year:

“Chrome is shipping support for lazy-loaded images with srcset, this allows the browser to use the layout width of the image in order to select the source url from the srcset.

For lazy-loaded images, CSS is often available before the image load begins. The browser can take the actual width of the image from CSS and use that as if it was the image’s sizes.”

The official WordPress announcement for the auto sizes for lazy loading explains:

WordPress documentation for the auto sizes feature explains:

“WordPress 6.7 adds sizes=”auto” for lazy-loaded images. This feature, which was recently added to the HTML specification, allows the browser to use the rendered layout width of the image when selecting a source from the srcset list, since lazy loaded images don’t load until after the layout is known.”

Is It Safe To Download WordPress 6.7?

Most developers discussing the latest version of WordPress in the private Dynamic WordPress Facebook group report that updating to the latest version is easy and trouble-free.

But some developers reported maintenance mode errors that were easily resolved by deleting the .maintenance file (maintenance mode file. The .maintenance mode error doesn’t happen because there’s something wrong with the update, it’s usually because there’s something going on with the upstream server that’s providing the update. The WordPress.org 6.7 documentation page was temporarily down so maybe the WordPress servers were experiencing too much traffic.

Featured Image by Shutterstock/Asier Romero