#190 - 159 Left Automattic Including WP Executive Director, ACF Ban & Security Update

Issue #190 | October 8, 2024 | Reading time: 16 mins

Hello!

Before we move on to this week’s news, we want to send our thoughts to everyone impacted by Hurricane Milton—stay safe and take care.

Josepha Haden Chomphosy steps down from Automattic as Executive Director of the WordPress project and several more employees have left after accepting the “Alignment Offer”. WP Engine has filed a lawsuit against Automattic, WordPress.org, and Matt Mullenweg.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by Kinsta, 20i and Omnisend

Kinsta Managed Hosting

Kinsta – Highest-rated managed WordPress hosting provider on G2 Check it out →

20i WordPress Hosting

Next-Gen Managed WordPress Hosting Check it out →

Omnisend

Boost your sales with email & SMS—without breaking the bank Check it out →

📰 WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

WordPress.org hosting page gets updated

The update has replaced WordPress.com with Pressable. To this change, Matt answered on X,” Pressable is doing really well right now, so Automattic wanted to promote it instead of WP.com in their slot.”

WordPress 6.7 Beta 2 released: The beta 2 is now available for download and testing.
Thank You, Josepha: WordPress Executive Director resigns: Josepha Haden Chomphosy has stepped down from Automattic, where she served as the Executive Director of the WordPress project. She was also leading Automattic’s open-source division, championing the efforts of developers, designers, community builders, and WordPress advocates.
WPGraphQL is canonical: WP GraphQL is transitioning into becoming a canonical community plugin on WordPress.org. The creator Jason Bahl is also joining Automattic.
Impact of WPEngine’s ban on ACF plugin: The ACF team was blocked from accessing WordPress.org and was unable to release updates for the free plugin when Automattic tweeted about a vulnerability. In response, John Blackbourn, WP Core Security Team Lead, tweeted, “Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF.” The ACF team then released ACF 6.3.8, a routine security release. They also made a copy of the update available to the WordPress.org Security team, who have posted it to the plugin repository.
Announcing the Third Cohort (2024 Q4) of the WordPress Contributor Mentorship Program: The Third Cohort (2024 Q4) will span over a six-week period from October 7- November 15.
Learn WordPress site remake: First two months: The performance stats for Learn WordPress in August and September have been promising. In August, the average course completion rate stood at 16.09%, rising to 18.51% in September. Learner satisfaction followed a similar trend, increasing from 90.30% in August to 92.65% in September.
WordPress.org rolls out Plugin Check and mandatory 2FA for new plugin submissions: The WordPress Plugin Directory has rolled out two important updates that will play a crucial role in optimizing the plugin submission process and also in enhancing the security of the plugin directory. The two new changes involve mandatory 2FA for plugin authors and the implementation of the Plugin Check plugin in the submission process.
Voting now open for WordPress Test Team Reps 2024-25: The voting for the new WordPress Test Team Reps is open until Friday, October 11.
Nomination for 2025 Training Team Reps: The call for nominations is open till October 25, 2024.
New Social Web Foundation Launched with Automattic’s support: The Social Web Foundation was officially launched on September 24, 2024, with a mission to foster a “growing, healthy, financially viable, and multi-polar Fediverse.”
Google rolls out new AI-organized search results, AI Overview links: Google’s organized search results will let you see content and perspectives from all around the web – articles, videos, forums, and more.
Google phases out support for noarchive meta tag: In a recent update to its Search Central documentation, Google has officially relegated the ‘noarchive’ rule to a historical reference section.

🗣️TALK OF THE TOWN

159 employees left Automattic and WP Engine files lawsuit

159 employees left Automattic: Automattic employees who disagreed with Matt were offered a buy-out package, named “ Alignment Offer”. Matt revealed that 159 people took the offer, ”159 people took the offer, 8.4% of the company, the other 91.6% gave up $126M of potential severance to stay! 63.5% were male. 53% were in the US. By division it impacted our Ecosystem / WordPress areas the most: 79.2% of the people who took it were in our Ecosystem businesses, compared to 18.2% from Cosmos (our apps like Pocket Casts, Day One, Tumblr, Cloudup).” Josepha Haden Chomphosy, the Executive Director of WordPress has also resigned.
WP Engine files lawsuit: The lawsuit has been filed against Automattic, Matt Mullenweg, and WordPress.org. Automattic responded to this by saying that the “complaint is flawed, start to finish. WP Engine also provided a workaround that allows ACF users to continue receiving updates without interruption.
Automattic—WP Engine term sheet: Automattic has published the full term sheet which was offered to WP Engine on September 20. The post also specifies, “Given WP Engine’s behavior, deception, and incompetence since September 20^th these terms are no longer sufficient”. Automattic also published a post answering the queries related to the WordPress trademarks.

Some writings/discussions on the subject:
The world without Matt Mullenweg: A WordPress odyssey

21 Years of WordPress

WordPress leadership proposal

🚨WEB SECURITY & VULNERABILITIES

A collection of web security and vulnerability news and updates for the past week

8,000 WordPress sites affected by Arbitrary File Upload vulnerability in WP Hotel Booking WordPress plugin

All users are advised to update to the latest version immediately.

Unauthenticated Stored XSS vulnerability in LiteSpeed Cache plugin affecting 6+ million sites: The vulnerability was recently patched and all users are to update to the latest version immediately.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 23, 2024 to September 29, 2024): There were 181 vulnerabilities disclosed in 159 plugins and 2 themes.
WordPress vulnerability & patch roundup September 2024: Monthly vulnerability round report from Sucuri.
WordPress vulnerability report — October 2, 2024: Weekly report from SolidWP.

🔌 NEW PLUGINS & THEMES

Be one of the first ones to explore some fresh plugins and themes

Raconteur theme

A theme with enlarged imagery and typography.

Fictionary theme: A typography-based, opinionated blogging theme.
Ziraj theme: A lightweight WordPress blog theme.
Block Accessibility Checks plugin: A plugin to configure a series of block checks to prevent WCAG accessibility errors in content.
Simplify Dashboard plugin: This adds a toggle in the admin bar to hide menu items you don’t use much.

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

WordPress Brand Survey 2024

The survey from WPShout has two parts which cover WordPress’ tone and voice and also look at specific phrases used throughout the WordPress interface.

Site Care Consultants Survey 2024 from MainWP is now live: The 2024 Site Care Consultants Survey is now available. The survey also includes key questions like: How much do you charge for web care, how many sites do you manage, what addon services do you offer, and more.
The PHP Foundation calls for sponsors: Help shape the future of PHP: The sponsorship will help tackle long-standing bugs, implement new features, and improve performance and security.
Introducing forkme: Misha Kaletsky has launched forkme, an app that will fork a GitHub repo and push commits directly to your fork replacing text to rename it in every file.
Announcing VoidZero: VoidZero founded by Evan You, is a company building the next-generation unified toolchain for JavaScript.
All new CPX.dev: Liam Hammett has launched cpx.dev, which allows users to run commands from PHP Composer packages without installing them into your app or as global dependencies.
Announcing Morpheus: A new WordPress update mirror: Morpheus is a lightweight, open-source mirror of the WordPress.org repository to ensure uninterrupted updates for WordPress sites.
Introducing Brands: The Brands functionality which was available as a premium plugin will now be integrated into WooCommerce core. This will be a part of the core with the release of WooCommerce 9.4.
WooCommerce 9.4 release postponed: WooCommerce 9.4, originally planned for October 21, 2024, will now be released on Monday, November 4, 2024. The reason for this change of release date is to align with the WordPress 6.7 release so as to test and ensure maximum compatibility.
Public Release Calendar for WooCommerce: The WooCommerce Release Calendar is a centralized page to find up-to-date information about the various release schedules. This includes dates for upcoming releases such as Beta, and RC, feature freeze dates, and information about the release cycle.
Stattic v0.0.5 released: The latest release includes a customizable 404 template file, improved autoStattic support, and more.
Plugin Planet is turning 10: Plugin Planet is celebrating its 10-year anniversary with its journey beginning in 2014 and on this occasion, they are also giving away 3 Lifetime licenses for any of their pro plugins.
ConvertKit has been rebranded to Kit: The rebrand also includes a revamped look and feel on the website and in the user account.
The Plus Blocks for Gutenberg has been rebranded to Nexter Blocks: The rebrand has merged everything under the Nexter brand to provide a unified platform for building WordPress websites with ease.
DICT Endorses WordCamp Asia 2025: The endorsement by DICT marks a significant milestone for the WordPress community in Asia and highlights the importance of this international event for the country’s growing ICT sector.
Mika Epstein is open to exploring new roles: Mika Epstein is searching for new full-time employment opportunities.
Several community members including Ryan McCue, sé reed, Morten Rand-Hendriksen, Ruben Garcia Jr, Josh Manders, Alex Standiford, Matt Paulson have reported getting blocked in Twitter by Matt/WordPress: In response to this Tia Wood made a song about it.
The SVN dumpstreams of all WordPress SVN repositories are now available: Kaspars Dambis on X posted about how the SVN dumpstreams are available from Internet Archive and how anyone can now recreate a local mirror of the WP-org repositories.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

Appreciating company contributions to the WordPress ecosystem: A proposal inspired from… Drupal: From Jean-Baptiste Audras
Solving the maker-taker problem: From Dries Buytaert
In conversation with Elena Brescacin: From Seriously Bud?
Andy Fragen on automatic update rollbacks in WordPress: From WP Tavern Jukebox
Private equity and the soul of WordPress: From The WP Minute
Fund the WordPress community (and maybe buy some WordCamp Organizers a coffee): From NewPath Consulting
Web AI for WordPress: From Pascal Birchler
How I commit to WordPress core: From Pascal Birchler
My core contribution workflow: From Aaron Jorbin
My WordPress core contribution workflow: From Felix Arntz
The critical role of UX in ecommerce SEO: From Yoast
A call for change: Gender equality in WordPress businesses: From WP Includes
Jetpack in Portland: WordCamp US 2024 highlights: From Jetpack

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

Adding Plugin Check (PCP) to your development workflow: From Tanner Record
Using the WordPress Playground block for Learn.WordPress.org: From Jonathan Bossenger
Automated testing using WordPress Playground and Blueprints: From Pascal Birchler
Autoloading WordPress options efficiently and responsibly: From Felix Arntz

📆 SAVE THE DATES

Do not miss a WordPress event ever again

WordPress Accessibility Day on Oct 9-10, 2024: The schedule is out.
WordCamp Youth Hackathon Skopje on October 19, 2024: An exciting event designed to inspire young people aged 14 to 17 in the world of WordPress.
Rome Core Days on November 8-9, 2024: This will be a two-day event dedicated to WordPress Core developers with round tables, open discussions, and contribution rooms. The schedule is out.
WordCamp Kerala on November 9, 2024: The call for sponsors, speakers and volunteers is out.
WordCamp Romania on November 14-15, 2024: Tickets are out.
WordCamp Malaysia on November 22-23, 2024: Tickets are out.
WordCamp Netherlands on 29-30 November 2024: The call for sponsors is out.
WordCamp Asia on February 20-22, 2025: The venue will be the Philippine International Convention Center, Manila, Philippines.
WordCamp Europe on 5-7 June 2025: The event will be held at Basel – Switzerland’s Capital for Art and Culture.
WordCamp US 2025 on August 26-29, 2025: The event is in the early planning stages.

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

EXCLUSIVE DEALS

4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
15% off yearly plans at Videvo (Coupon Code – WPV15)