A few weeks ago, I discussed the escalating conflict between Automattic/Matt Mullenweg and WP Engine.

At that time, the exchange was largely verbal, highlighted by competing cease and desist letters. However, the situation appears to be intensifying, with WP Engine now initiating a formal lawsuit against Matt Mullenweg and Automattic.

This article focuses on what I believe is one of the most significant developments in this unfolding drama:

During the weekend of October 12th, Matt Mullenweg and his team undertook the bold step of acquiring the Advanced Custom Fields plugin (ACF) from Delicious Brains, a firm that WP Engine had purchased a few years prior.

If you support Mullenweg’s perspective, you might argue that they simply “forked” Advanced Custom Fields, an action permissible under the GPL license.

On the other hand, I refer to it as a takeover due to a significant distinction between Mullenweg’s actions and a traditional fork.

Instead of creating a new, independent plugin by forking the ACF codebase, Mullenweg chose to take control of the Advanced Custom Fields plugin hosted on WordPress.org, rebranding it as Secure Custom Fields.

In my view, this presents the main concern:

If a user updates Advanced Custom Fields via their WordPress dashboard, the plugin will transform into Secure Custom Fields, which can give the impression of a malicious supply chain attack rather than simply being a “fork.”

The newly introduced Secure Custom Fields plugin continues to utilize the Advanced Custom Fields slug, which is technically a violation of Rule 17 of the WordPress.org plugin directory.

There are two options:

If you prefer not to be automatically upgraded to the new Secure Custom Fields plugin, you must manually update your plugin by downloading the version directly from the Advanced Custom Fields website. Here are instructions from the ACF team.

For future updates after you complete the initial manual update, the plugin will fetch updates directly from ACF’s servers, rather than from WordPress.org.

Simply update your existing version of the plugin as you typically would – via your WordPress dashboard. The plugin will then shift from ACF to SCF.

Note – none of these changes impact ACF Pro, which has been receiving updates from ACF’s servers prior to these changes.

This situation has undeniably sparked a significant amount of discussion, as it’s quite unprecedented in the realm of WordPress (and in many open-source projects overall). It’s also attracting some attention in mainstream media.

I can’t help but think if this is just the initial takeover we will witness, since other WP Engine plugins, such as NitroPack, are also restricted from WordPress.org.

Additionally, I am curious about how a judge might perceive these actions, especially since Mullenweg/WordPress has indicated that he will put a stop to them if WP Engine withdraws its lawsuit.

…

Remember to enroll in our crash course focused on enhancing the speed of your WordPress site. Discover more details below:

Colin Newcomer is a seasoned WordPress enthusiast who has dedicated over seven years to writing about WordPress and has been utilizing the software since 2006. His background also includes practical expertise in SEO, content marketing, affiliate marketing, and various other aspects of digital marketing.

Engage with us in our Facebook group for WordPress professionals. This is a great place to find answers, exchange tips, and connect with fellow WordPress experts. Join today at no cost!

Welcome to DediRock, your trusted partner in high-performance hosting solutions. At DediRock, we specialize in providing dedicated servers, VPS hosting, and cloud services tailored to meet the unique needs of businesses and individuals alike. Our mission is to deliver reliable, scalable, and secure hosting solutions that empower our clients to achieve their digital goals. With a commitment to exceptional customer support, cutting-edge technology, and robust infrastructure, DediRock stands out as a leader in the hosting industry. Join us and experience the difference that dedicated service and unwavering reliability can make for your online presence. Launch our website.