Mullenweg Takes On Inc Magazine For “Biased” Interview via @sejournal, @martinibuster

Matt Mullenweg accused Inc Magazine of distorting an interview with him, publishing verifiably fake facts and quoting people who lacked credibility. Mullenweg posted compelling examples of how the Inc magazine misrepresented his quotes and presented false fact, citing the selection of unflattering photos as evidence of a conscious effort to negatively slant their interview of him.

Mullenweg explains why he agreed to the interview:

“When Inc Magazine reached out to have David H. Freedman (website powered by WordPress) write a feature piece I was excited because though Inc wasn’t a magazine I have read much since I was a teenager, David seemed like a legit journalist who usually writes for better publications like The Atlantic. I opened up to David with a number of vulnerable stories, and allowed the photo shoot in my home in Houston.”

The article begins with an unflattering portrait of Mullenweg as a control freak that is fussy about the kind of toilet paper and soap is provided at Automattic’s offices. Mullenweg writes that he had shared an anecdote with the writer of the time he visited Google’s headquarters in 2004 and was surprised by what he felt was “cheap toilet” paper. Years later when he had his own offices he made the decision to spend extra on good soap and toilet paper to benefit his employee’s experience at work. In other words, the choice to do that came from altruism and a concern for others, not a desire to control every detail.

But that’s not how Inc magazine portrayed it.

They write:

“Stooping to fling open a storage cabinet built into the bathroom wall, he points to a neat stack of wrapped toilet paper rolls. “The best toilet paper you can buy,” he assures me. “How much extra does really nice toilet paper cost? A buck or two?” The handsome bottles of soap by the sinks are premium, too, he adds.

I ask him who at Automattic, the estimated $710-million company of which Mullenweg is CEO, is responsible for toilet paper and soap quality control?

“Me,” he says, beaming.

Of course, Mullenweg’s control of Automattic extends well beyond the bathroom walls.”

Grim Images In Photographs

The author of the article described Mullenweg as a young looking forty year old with a “near-constant grin” which contradicted the photographs Inc chose to publish, neither of which showed him smiling. Of the two photographs from the interview they chose to publish, one captures Mullenweg mid-blink, resulting in an absurd image of him typing with his eyes closed.

There are two other photographs from the past nine and twelve years ago which do show him smiling. Mullenweg’s smile is not an affectation; it’s an authentic expression. Videos of him participating in interviews or speaking publicly consistently show him smiling. Mullenweg is correct to point out that Inc magazine made a deliberate choice to not publish an image of him smiling, which is his characteristic expression, as noted in the article itself.

Poorly Researched Article

Mullenweg’s critique of the article zeroes in on a series of false statements that are indicative of poor research, including a consistent misrepresentation of a company’s earnings with its valuation.

One of the false facts wrongfully asserts that Mullenweg coded WordPress in three “obsessive days” when the actual time period was four months. This might seem minor but it’s not because it’s evidence of what Mullenweg points out is poor research that could have been easily verified on Wikipedia.

His critique is thoroughly convincing and shows how he agreed to the interview with openness and the expectation of balanced reporting. His dismay at the results is palpably communicated in his blog post about it.

Nevertheless he goes on to say that he supports journalism and puts the blame on the editor of the article.

He writes:

“I know a lot of entrepreneurs follow me and I don’t want your takeaway to be “don’t talk to journalists” or “don’t engage with mainstream media.”

…this is a good example of where a decent journalist can’t overcome a crappy editor and quality control. I probably wouldn’t be excited to work with Inc Magazine again while Mike Hofman is in charge as editor-in-chief, he’s clearly overseeing a declining brand. But I will continue to engage with other media, and blog, and tweet, and tell my story directly.

When an editor wants to make you look good, they can! If they decide they want to drag you, they can too. Everything in my interactions with David and Inc made it seem this would be a positive piece, so be careful.

We’ll see if Inc Magazine has any journalistic integrity by their updates to the article.”

Rightfully Disappointed

Mullenweg researched the interviewer and verified that they were a competent and respectable writer. From Mullenweg’s point of view the Inc magazine article was poorly researched and heavily slanted against him, what he termed a hit piece.

Read Mullenweg’s account of the interview:

Inc Hit Piece

Featured Image by Shutterstock/tomertu

Mullenweg Pauses WordPress Services – Hopes To Reopen Next Year via @sejournal, @martinibuster

Matt Mullenweg announced the abrupt pause in services offered by WordPress.org, affecting plugin submissions, reviews, theme submissions, and additions to the photo directory. He offers to keep providing these services to WP Engine, citing the recent court order against him and Automattic that compels him to offer “free labor and services.”

Pause For The Holidays

Mullenweg published a post on the official WordPress blog to announce a pause in free services offered by WordPress.org to give the “many tired volunteers around WordPress.org a break for the holidays.”

The pause affects:

• New account registrations on WordPress.org
• New plugin directory submissions
• New plugin reviews
• New theme directory submissions
• New photo directory submissions

The pause doesn’t affect the ability to install new instances of WordPress sites or accounts, which sounds contradictory.

Here’s what he wrote in his list of what services are paused:

“New account registrations on WordPress.org (clarifying so press doesn’t confuse this: people can still make their own WordPress installs and accounts)”

Mullenweg makes a point to note that the pause doesn’t affect WP Engine, stating that he’s legally required to keep providing free labor and services” services to WP Engine, writing that if WP Engine requires those services they can have their “high-priced attorneys” speak to his “high-priced attorneys” to gain access.

He then shared a cryptic message that implied there was a chance that WordPress may not resume those services in 2025, saying that it hinged on his being able to find the “time, energy, and money” to undo the pause in 2025, which he writes is being expended defending against WP Engine’s lawsuit against him and Automattic.

Mullenweg wrote:

“Right now much of the time I would spend making WordPress better is being taken up defending against WP Engine’s legal attacks. Their attacks are against Automattic, but also me individually as the owner of WordPress.org, which means if they win I can be personally liable for millions of dollars of damages.”

He signs off inviting those who’d like to fund those attacks on him to sign up for WP Engine and that those who don’t can sign up for other web hosts, linking to both WP Engine and a WordPress.org page that offers promotions to induce WP Engine clients to switch away.

Read Mullenweg’s announcement here:

Holiday Break

Featured Image by Shutterstock/MPIX

Mullenweg Disgusted & Sickened As WP Engine Regains Access via @sejournal, @martinibuster

WP Engine regained control of their Advanced Custom Forms plugin and login access to WordPress.org. Matt Mullenweg responded by expressing that he is “disgusted and sickened.”

Mullenweg tweeted about how he felt about how things turned out:

“I’m disgusted and sickened by being legally forced to provide free labor and services to @wpengine, a dangerous precedent that should chill every open source maintainer. While I disagree with the court’s decision, I’ve fully complied with its order. You can see most changes on the site. They have access to ACF slug but haven’t changed it… must not have been the emergency they claimed.”

The response to Matt’s tweet was predictable.

One person reflected Matt’s words back at him:

I’m disgusted and sickened that you released software as GPL, made it intimately dependent on a private website+APIs you personally own and then you’re shocked when you learn you can’t discriminate against users

Another accused Mullenweg of tricking the WordPress community:

“And what about all of the free labor that you, @photomatt , tricked the WordPress community into providing to your personal .org website that the community believed was owned by the Foundation?”

Despite the compliance, Mullenweg pointed out that WP Engine had yet to change the plugin slug, questioning their claim of urgency. The ACF team subsequently reclaimed the plugin slug and tweeted an announcement about it.

On December 13, 2024, WP Engine’s official Advanced Custom Fields account confirmed on X (formerly Twitter) that they had regained access. The WordPress.org plugin directory now displays the original ACF plugin instead of Mullenweg’s forked version, Secure Custom Fields.

The ACF team tweeted:

“We’re pleased to share that our team has had account access restored on WordPress dot org along with control of the ACF plugin repo. This means all ACF users can rest assured that the ACF team you trust is once again maintaining the plugin. There’s no action required if you have installed ACF directly from the ACF website or you are an ACF PRO user.”

Members of the WordPress community congratulated WP Engine.

Some offered congratulations:

“Excellent news. Congratulations!”

Others expressed their happiness that ACF’s access was restored:

Happy for @wpengine. You have done a great job.

👏🏼 YES!!!!
https://x.com/CaroManelR/status/1867934316992610459

Another person tweeted:

NEVER trusting wordpess dot org again.

Origin Of Mullenweg – WP Engine Dispute

Matt Mullenweg claims that WP Engine does not contribute enough to the WordPress ecosystem. He has also raised concerns about WP Engine’s use of the word “WordPress” and has written about his years long attempt to get WP Engine to pay a “fair share” back into the WordPress open source project. On the September 20, 2024 Matt Mullenweg publicy denounced WP Engine at the United States WordCamp conference, after WP Engine declined to agree to his demands for $30 million dollars.

WP Engine sued Automattic and Matt Mullenweg in federal court, obtaining a preliminary injunction that required Automattic and Mullenweg to restore WP Engine’s access to WordPress.org, the plugin repository, logins and to remove a WP Engine customer list from a website Mullenweg created to encourage customers to leave WP Engine.

Mullenweg’s History Of Disputes

There is some history of Mullenweg engaging in disputes related to GPL licensing of code and trademarks. In 2010 Mullenweg rightfully challenged Chris Pearson and his theme company Thesis over software licensing. Chris Pearson himself has acknowledged that he was ignorant at the time about software licensing.

Mullenweg escalated his dispute with Pearson by offering Thesis customers any premium theme of their choice in exchange for abandoning their use of the Thesis them. These disputes caused Pearson to lose a significant amount of business and gain a negative perception in the WordPress community, which he described in a blog post:

“…I was woefully ignorant about software licensing, and I felt as though I was being backed into a corner and asked to accept something I didn’t fully understand. Instead of handling it in a measured, polite manner, I was a jerk.

I made a mistake, and I paid dearly for it.The WordPress community’s reaction towards me was incredibly negative, but on top of that, Matt did whatever he could to further damage what was left of my business. His most blatant effort in this regard was making a public offer to buy Thesis customers the premium, GPL-licensed Theme of their choice if they quit using Thesis.”

Three years later Mullenweg purchased the Thesis.com domain name which began another dispute with Pearson that Mullenweg also won. His motivation for going after the Thesis.com domain name was never fully acknowledged but the WordPress community largely understood it as “retribution” against Pearson.

The comments in a WP Tavern report about Automattic were largely negative, with one person’s comment representative of the negative sentiment:

“I don’t think anyone is saying what Automattic did was illegal, they’re saying it was unethical.

It’s possible to be a jerk without breaking the law, but that doesn’t make it acceptable behavior.”

In 2016 Matt Mullenweg initiated a dispute with Wix in relation to GPL licensing. Wix’s CEO responded with his own blog post showing how Wix had contributed over 224 open source projects, writing:

“Yes, we did use the WordPress open source library for a minor part of the application (that is the concept of open source right?), and everything we improved there or modified, we submitted back as open source, see here in this link – you should check it out, pretty cool way of using it on mobile native. I really think you guys can use it with your app (and it is open source, so you are welcome to use it for free). And, by the way, the part that we used was in fact developed by another and modified by you.”

Wix eventually removed the disputed code from their mobile app.

Mullenweg Complies To Court Order… With Humor

The court’s ruling emphasizes the importance of adherence to legal agreements within the WordPress ecosystem. WP Engine’s victory may bolster its chances of prevailing in the ongoing federal lawsuit. Automattic’s to their loss signals their intention to challenge the outcome during a full trial, stating:

“We look forward to prevailing at trial as we continue to protect the open-source ecosystem during full-fact discovery and a full review of the merits.”

Matt Mullenweg continues to provoke WP Engine, only this time using humor. Automattic removed a checkmark from the WordPress.org login page that previously required users to affirm that they are not associated with WP Engine. Today there’s a checkbox asking users to affirm that pineapple on pizza is delicious.

Automattic Removes WP Engine Client List From Tracker Site via @sejournal, @martinibuster

Automattic removed a spreadsheet containing the domain names of WP Engine customers from the WP Engine Tracker website. The removal is in response to a preliminary injunction granted to WP Engine, ordering Automattic and Matt Mullenweg to remove the spreadsheet within 72 hours.

The preliminary injunction was warmly received on X (formerly Twitter), a tweet by Joe Youngblood representative of the general sentiment:

“The ruling was a gigantic win for small businesses and entrepreneurs that rely on open source keeping it’s promises. That includes allowing webhosts to host and not stealing code repositories.

I am hopeful the full outcome of this looks much the same.”

Someone else tweeted:

“Unbiased parties watching on the sidelines think the court got it right. This was obvious from day one.

Next step for you guys is to try to settle out of court to prevent further embarrassment and reduce potential risk in damages.”

Mullenweg’s Dispute With WP Engine

Matt Mullenweg began an attack against WP Engine on September 20, 2024 after WP Engine declined to pay tens of millions of dollars, what WP Engine’s attorney’s called “extortionate monetary demands” in a cease and desist letter sent to Automattic’s Chief Legal Officer on September 23rd.

On November 6th Automattic intensified the pressure on WP Engine by launching a website called WP Engine Tracker that offered a list of WP Engine customers that could be used by other web hosts to solicit the clients with offers to leave WP Engine.

Solicitations of WP Engine customers apparently followed, as related by a Redditor in a discussion about the WP Engine Tracker website:

“I was out of the office for some medical procedures, so I missed the WPE Tracker thing. However, this explains why I’ve received unsolicited hosting calls from certain operations. Clearly, someone is mining it to solicit business. Absolutely aggravating and also completely expected.

All this does is further entrench me on WP Engine. Good work, Matt, you dweeb.”

The WP Engine Tracker website became evidence of the harm Mullenweg was causing to WP Engine and was cited in the request for a preliminary injunction.

The judge sided with WP Engine and granted the preliminary injunction, requiring among many other things that Automattic and Mullenweg take down the list of WP Engine customers.

The court order states:

“Within 72 hours, Defendants are ORDERED to:

…(a) remove the purported list of WPEngine customers contained in the “domains.csv” file linked to Defendants’ wordpressenginetracker.com website (which was launched on or about
November 7, 2024) and stored in the associated GitHub repository located at https://github.com/wordpressenginetracker/wordpressenginetracker.github.io.”

The CSV file was subsequently removed although the link to a non-existent file , with a link showing zero :

Screenshot Of WP Engine Tracker Website

Clicking the link leads to a 404 error response message.

Screenshot Of 404 Error Response For CSV Download

A pull request on GitHub shows that a request was made to remove the CSV file on December 11th.

“Remove CTA to download list of sites #29

wordpressenginetracker commented 9 hours ago
This PR removes the text and download link to download the list of sites that have are still using WPE”

Screenshot Of GitHub Pull Request

Advanced Custom Fields Plugin

Automattic removed WP Engine’s Advanced Custom Fields (ACF) plugin from the official WordPress.org plugin repository and replaced it with Automattic’s cloned version, renamed as Secure Custom Fields (SCF).

The preliminary injunction orders Automattic to also restore access to the Advanced Custom Fields (ACF) plugin repository:

“Within 72 hours, Defendants are ORDERED to:

…(v) returning and restoring WPEngine’s access to and control of its Advanced Custom Fields (“ACF”) plugin directory listing at https://wordpress.org/plugins/advanced-customfields, as it existed as of September 20, 2024.”

The cloned SCF plugin currently still exists at that URL, although Automattic still has time to take it down.

Screenshot Of SCF Plugin In The ACF Directory Listing

Featured Image by Shutterstock/tomertu

Judge Sides With WP Engine Against Automattic & Mullenweg In WordPress Dispute via @sejournal, @martinibuster

A judge ruled in WP Engine’s favor in their request for a preliminary injunction against Automattic and Matt Mullenweg. The court agreed that WP Engine will suffer irreparable harm if the injunction is not granted and giving the defendants (Automattic and Mullenweg) 72 hours to return things to the way they were as of September 20th, 2024.

The judge ruled against Mullenweg and Automattic on every argument, granting WP Engine a preliminary injunction. The ruling requires the defendants to restore WP Engine’s access to WordPress.org, regain control of the WordPress.org directory listing for the Advanced Custom Fields (ACF) plugin, and remove a list of WP Engine customers from the domains.csv file linked on the wordpressenginetracker.com website.

There were six parts labeled A – F that outline the judge’s analysis of the case:

A. Success on the Merits

B. Irreparable Harm

C. Balance of Equities

D. Public Interest

E. Bond

F. Scope of Injunction

A. Success on the Merits

On WP Engine’s “claim for tortious interference with contractual relations” the judge ruled:

“Defendants’ arguments in opposition do not compel a different conclusion.

Defendants’ argument that the interference WPEngine alleges consists of acts they had a right to take fares no better.”

B. Irreparable Harm

Mullenweg and Automattic completely failed at defending against WP Engine’s claims of irreparable harm if the injunction isn’t granted. The judge wrote:

“Defendants counter with four arguments. None is persuasive”

C. Balance of Equities

In this part of the ruling the judge had to weigh the impact of the injunction on both parties. The judge found that WP Engine had good reason for obtaining an injunction to prevent further harm and that there would be no impact on Automattic or Mullenweg.

The judge wrote:

“The conduct described at length above – including the termination of WPEngine’s access to WordPress, the interference with the ACF plugin, and the additional burdens imposed on WPEngine’s customers, such as the sign-in pledge – demonstrates that WPEngine has a significant interest in obtaining preliminary injunctive relief.

Defendants’ arguments in opposition do not establish that they will suffer any damage that overrides WPEngine’s interest in obtaining relief. …Requiring Defendants to restore access on those terms while this action proceeds imposes a minimal burden.”

D. Public Interest

This part of the ruling addresses how granting the injunction impacts parties beyond the plaintiff and defendants. The judge concluded that denying the preliminary injunction would cause significant harm.

The court explained:

“Here, the public consequences of withholding injunctive relief are significant. Mullenweg himself acknowledges that ‘[t]oday, more than 40% of all websites run on WordPress.’

…Over two million websites run the ACF plugin Mullenweg allegedly tampered with, and those users rely on the stability of the plugin, and WordPress more broadly, to operate their websites, run their businesses, and go about their day online.

Moreover, the availability of WordPress as open-source software has created a sector for companies to operate at a profit. This includes Mullenweg’s own companies like Automattic and Pressable, and as Mullenweg himself acknowledged in 2017, it also includes WPEngine, which at the time, Mullenweg described as ‘the largest dedicated managed WP host…’

Those who have relied on the WordPress’s stability, and the continuity of support from for-fee service providers who have built businesses around WordPress, should not have to suffer the uncertainty, losses, and increased costs of doing business attendant to the parties’ current dispute.

Defendants’ arguments in opposition do not persuade otherwise.

…Accordingly, the final Winter element – the public interest – weighs in favor of granting preliminary injunctive relief.”

E. Bond

Automattic and Mullenweg argued that WP Engine should be required file a bond of $1.6 million to ensure that they are compensated for potential costs and damages if it’s later found that the preliminary injunction was granted without sufficient basis.

The judge agreed with WP Engine’s argument that reverting to the status quo, to how things were on September 20th, would have no effect.

They wrote:

“WPEngine’s arguments are persuasive. …the Court finds that any harm to Defendants resulting from the issuance of preliminary injunctive relief is unlikely, as it merely requires them to revert to business as usual as of September 20, 2024. Accordingly, the Court declines to require WPEngine to post a bond.”

F. Scope Of Injunction

The court has ordered the defendants, their coworkers, and anyone helping them to stop doing the following things:

• Preventing WP Engine, its employees, users, customers, or partners from accessing WordPress.org.
• Disrupting WP Engine’s control over or access to plugins or extensions hosted on WordPress.org
• Modifying WP Engine plugins on WordPress installations (websites built with WordPress software) through unauthorized auto-migrate or auto-update commands
• The court ordered that the defendants take actions within 72 hours to address WP Engine’s claims and restore things to the way they were on September 20, 2024.
• Delete the list of WP Engine customers from the WP Engine Tracker website and the GitHub repository.
• Restore WP Engine employee login credentials to WordPress.org and login.wordpress.org.
• Disable any “technological blocking” like IP blocking, that were set up around September 25, 2024.
• Remove the checkbox added on October 8, 2024, at login.wordpress.org, which required users to confirm they were ‘not affiliated with WP Engine in any way, financially or otherwise.’
• Restore WP Engine’s control over its Advanced Custom Fields (ACF) plugin directory listing to the way it was on September 20, 2024.

The injunction goes into effect immediately and will remain until the court issues a final judgment after the trial.

A Win For WP Engine And The WordPress Community

Many people agree with the principle that those who profit from WordPress should give back to it. However the overwhelming sentiment on social media has not been supportive of how Mullenweg’s actions against WP Engine. Today a judge agreed with WP Engine and issued a preliminary injunction in their favor.

Featured Image by Shutterstock/Brian A Jackson

Automattic Acquisition Will Bring AI Into WordPress via @sejournal, @martinibuster

Automattic announced the acquisition of WPAI, a company that creates AI-powered functionalities that make WordPress easier and more efficient to use. The core technologies of the current apps will be integrated into new offerings by Automattic.

WPAI

WPAI released it’s first product, CodeWP in 2022. CodeWP was an AI integrated development environment (IDE) for developers, enabling them to quickly generate code that’s optimized for performance and WordPress standards.

The second app produced by WPAI is AgentWP, released in August 2024. AgentWP was an autonomous AI agent that could proactively take action such as as making design changes. It indexes a website and is able to improve WordPress website workflow from content to code generation.

The technology of both apps will be integrated into WordPress.

According to the announcement by WPAI:

“We are excited to combine forces with Automattic to push the boundaries of how we can apply artificial intelligence to be more impactful on the CMS that powers the majority of the internet,’ says James LePage. ‘By integrating our technology and research with current and future Automattic products, we’ll be able to accelerate towards our goal of making WordPress, the Operating System of the Web, more accessible to everybody.”

Automattic explains:

“WPAI is an AI startup, focused on building AI solutions for WordPress. The brilliant founding team behind it—James LePage, Greg Hunt, and Ovidiu “Ovi” Iulian Galatan—will be joining Automattic to lead the exploration of applied AI as an interaction paradigm for WordPress. They’ll be working on testing, building, and integrating innovative AI solutions into the core ecosystem to redefine how users and developers work with WordPress.”

Read the announcement on Automattic:

Automattic Welcomes WPAI

Read the announcement on WPAI:

WPAI Has Been Acquired by Automattic

Check out WPAI’s free WP Chat tool that answers WordPress related questions (while it’s still available):

https://wp.chat

WPForms Plugin Vulnerability Affects Up To 6 Million Sites via @sejournal, @martinibuster

The WPForms plugin for WordPress exposes websites to a vulnerability that allows attackers to update subscriptions and issue refunds. This flaw enables attackers to modify data they normally should not have access to.

Missing Capability Check

The vulnerability is due to a missing capability check in a function within the plugin called wpforms_is_admin_page, which means that the plugin doesn’t check for appropriate permissions of the user attempting to make a change with this function. That means that the plugin allows data to be modified by attackers lacking sufficient privileges.

Attackers need to acquire at least subscriber level permissions in order to launch an attack. Normally this kind of attack doesn’t attain this high of a severity rating. But it may be because sites that have users that pay for a subscription are likely to have subscriber level users. This may be why the severity level of this authenticated attack is higher than general.

The Wordfence announcement explains it like this:

“The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘wpforms_is_admin_page’ function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions.”

It’s recommended that users of versions WPForms plugin users from versions 1.8.4 up to an including 1.9.2.1 update their plugins.

Read the Wordfence security alert:

WPForms 1.8.4 – 1.9.2.1 – Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

Featured Image by Shutterstock/Tithi Luadthong