Skip to content
Today
Sections

Product Independently confirmed2 publishers 3 min read Published

The board vote that sidelined Mullenweg left WordPress.org's patch pipeline in his hands

Automattic's directors put Matt Mullenweg on paid leave and handed the CEO job to their CFO. The plugin directory and the trademark that WordPress sites depend on are still his, held personally outside the company.

The Product Desk

Send a correction

What happened

  • Automattic's board placed founder and CEO Matt Mullenweg on a paid leave of absence over his objections and made finance chief Mark Davies interim CEO.
  • Mullenweg says the board gave him 50 minutes' notice of the meeting and not enough time to seek legal counsel, and he named Davies, Ann Dunwoody, Toni Schneider and Sue Decker in a company-wide Slack message.
  • He voted against the move, was outvoted, and remains a member of Automattic's board.
  • WordPress.org executive director Mary Hubbard wrote that Mullenweg remains the leader of the WordPress project and that teams, priorities and work continue as planned.
  • The board acted while Mullenweg's fight with WP Engine, whose access to WordPress.org patches, plugins and security updates he cut off, is still in court.

Why it matters

  • Who's exposed exposure A WordPress customer's patch supply answers to a person outside the reach of its contract. Brue still files this as vendor risk after the leadership change.
  • Who has to decide decision Diligence and renewal questions now have to go to two addresses, because one entity sells hosting while another ships updates and licenses the name.
  • What it limits constraint Teams hoping the change unlocks roadmap money get stabilisation and compliance work instead, on Brue's reading of the CFO appointment.
  • What doesn't add up contradiction The two published readings point different ways: the WordPress project says its work continues as planned, while Brue infers exposure severe enough that the board dropped fairness and optics to move fast.

The security update that lands on an enterprise WordPress site comes from the plugin and theme directory at WordPress.org. Mullenweg owns and controls that directory personally, along with the WordPress trademark, according to Frank Dickson, principal analyst at Dickson Research [2][3]. "The part of WordPress that actually keeps enterprise IT up at night isn't Automattic's org chart," Dickson said [2]. The board, in his account, "changed who runs its hosting business without changing who controls the distribution pipeline millions of those hosted sites still depend on" [3].

Of the three dependencies Dickson names, the hosting operator, the update directory and the trademark, the vote moved one [19].

Automattic's emailed statement to Computerworld said that "Matt Mullenweg is currently on leave from Automattic," that Davies "will lead the company as interim CEO," and that the board "has full confidence in Mark's leadership" [6].

A vendor file on WordPress risk usually puts the contract and the support terms with Automattic. In production the code arrives from a directory Automattic does not own [3], and WordPress.com, Automattic's own product, runs on WordPress.org too [9].

The precedent is already on a docket. Mullenweg denied WP Engine access to WordPress.org resources, including patches, plugins and security updates [10]. That litigation continues after a series of rulings in WP Engine's favour [11]. "I would still treat this as vendor risk, because WordPress.org is still controlled by Matt, separate from Automattic," said Melody Brue, analyst-in-residence at Moor Insights & Strategy, who has tracked WordPress for years [4].

Every deployment has two names attached, the party that bills you and the party that ships you code. Where the second name is WordPress.org, this week left your risk register exactly as it was, and the trademark you use in your own marketing belongs to the same individual it did last month [3]. Where the second name is a host that mirrors or stages updates for you, the useful question is what that mirror does on the day directory access stops. WP Engine has already run that test [10].

Brue read the speed as a signal about the board rather than the product. She said the CFO's appointment "definitely shows some stabilization and possibly some legal compliance cleanup," and added, "What it doesn't say is renewed product investment" [21].

Mullenweg, still a director, posted on X that he needs to hire sysadmins and security researchers quickly and that no applicant may come from Automattic. In the same post he said he supports Davies as interim CEO, then added: "But I think it's probably good if I move some of my stuff currently hosted there, elsewhere" [17]. Neither Automattic nor Mullenweg told Computerworld whether the board's next steps involve his control of WordPress.org [13].

What to watch

  • Whether any settlement between the board and Mullenweg moves WordPress.org or the WordPress trademark inside Automattic.
  • The next rulings in the WP Engine litigation, and any change to who can pull from the WordPress.org directory.
  • Whether Automattic puts an end date on the leave or makes Mark Davies permanent CEO.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption
Not scored
Hype gap+10
Incentives68
Confidence61
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Enterprise IT executives who rely on WordPress may find the change means little as long as Mullenweg fully controls WordPress.org, which handles all of the product's patches and updates.

    Reported SupportedView cited source
  2. [2]

    "The part of WordPress that actually keeps enterprise IT up at night isn't Automattic's org chart. It's WordPress.org, the plugin and theme directory every WordPress site pulls its security updates from, and the WordPress trademark."

    Reported Supported Source: Frank Dickson, principal analyst at Dickson Research, quoted by ComputerworldView cited source
  3. [3]

    "Mullenweg owns and controls both personally, outside of Automattic, and nothing about this week's vote touches that. He also remains a director on Automattic's board. The company changed who runs its hosting business without changing who controls the distribution pipeline millions of those hosted sites still depend on."

    Reported Supported Source: Frank Dickson, principal analyst at Dickson Research, quoted by ComputerworldView cited source
  4. [4]

    "I would still treat this as vendor risk, because WordPress.org is still controlled by Matt, separate from Automattic."

    Reported Supported Source: Melody Brue, analyst-in-residence at Moor Insights & Strategy, who has closely tracked WordPress for yearsView cited source
  5. [5]

    Automattic's board of directors abruptly placed CEO Matt Mullenweg on a paid leave of absence despite his objections.

    Reported SupportedView cited source
  6. [6]

    Automattic's statement emailed to Computerworld: "Matt Mullenweg is currently on leave from Automattic. Mark Davies, Automattic's CFO, will lead the company as interim CEO. The Board has full confidence in Mark's leadership and in the team's ability to execute against the company's priorities."

    Reported SupportedView cited source
  7. [7]

    Mullenweg, a board member, voted against the change but was outvoted, and he remains a member of Automattic's board.

    Reported SupportedView cited source
  8. [8]

    WordPress.org executive director Mary Hubbard wrote: "Matt remains the leader of the WordPress project and I remain Executive Director of WordPress. Our teams, priorities, and work continue as planned."

    Reported SupportedView cited source
  9. [9]

    WordPress.com, an Automattic product, runs on WordPress.org.

    Reported SupportedView cited source
  10. [10]

    Mullenweg had denied WP Engine access to WordPress.org resources, including patches, plugins and security updates for the software.

    Reported SupportedView cited source
  11. [11]

    Mullenweg's dispute with WordPress hosting provider WP Engine resulted in a series of legal rulings in WP Engine's favour, and the litigation is still ongoing.

    Reported SupportedView cited source
  12. [12]

    Automattic has not publicly stated how long Mullenweg's leave will last.

    Reported SupportedView cited source
  13. [13]

    Computerworld reported that next steps are unclear, including whether the leave is permanent and whether board negotiations involve whether Mullenweg continues to control WordPress.org, and that neither Automattic nor Mullenweg provided clarification.

    Reported SupportedView cited source
  14. [14]

    Mullenweg alleged that the board gave him 50 minutes' notice before the meeting and insufficient time to seek legal counsel.

    Reported SupportedView cited source
  15. [15]

    In a company-wide Slack message seen by TechCrunch, Mullenweg wrote: "I won't be able to make the [meeting] tomorrow. @Mark Davies has conspired with @Ann Dunwoody, @Toni, and @Sue Decker behind my back and they voted to put me on a paid leave of absence."

    Reported SupportedView cited source
  16. [16]

    Mullenweg posted on X: "the next step in this playbook is to restart the smear attacks, so get ready for some National Enquirer rumors or hit pieces."

    Reported SupportedView cited source
  17. [17]

    Mullenweg posted: "I really need some great sysadmin and security researchers to hire really quick, no one from @automattic. I'm on the board there and fully support Mark Davies in his interim CEO role. But I think it's probably good if I move some of my stuff currently hosted there, elsewhere."

    Reported SupportedView cited source
  18. [18]

    Mullenweg offered insiders who disagreed with his direction an exit package worth either six months' pay or $30,000.

    Reported SupportedView cited source
  19. [19]

    Of the three WordPress dependencies Dickson identifies for enterprise buyers (the hosting operator, the WordPress.org update and plugin directory, and the WordPress trademark), the board's vote changed control of one.

    Derived Supported
  20. [20]

    "It has to be some exposure or risk that was severe enough that speed outweighed any optics or fairness. Boards don't generally move that abruptly."

    Reported Insufficient Source: Melody Brue, Moor Insights & Strategy, on the speed of Mullenweg's removalView cited source
  21. [21]

    Brue said the appointment of the CFO as interim CEO "definitely shows some stabilization and possibly some legal compliance cleanup. What it doesn't say is renewed product investment."

    Reported Insufficient Source: Melody Brue, Moor Insights & StrategyView cited source
  22. [22]

    TechCrunch reported that some Automattic employees were "ecstatic" or "relieved" at the board's decision.

    Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. computerworld.com

    1 article · September 11, 2026

    Automattic CEO Matt Mullenweg is out: Does this mean long-term viability, or liability, for WordPress customers? – Computerworld
  2. techradar.com

    1 article · September 10, 2026

    Automattic CEO Matt Mullenweg 'forced' into leave of absence by WordPress parent company board | TechRadar

Topics and entities

Topics

Entities