WordPress.org reorganized the popular Advanced Custom Fields (ACF) plugin and brought it to the platform under the name “Secure Custom Fields”. This move was made in order to remove WP Engine’s commercial redirects on ACF and resolve a security issue detected in the plugin. However, this intervention is considered an extension of the existing legal disputes between Automattic CEO Matt Mullenweg and WP Engine. This step was described by WP Engine as seizing the plugin without the approval of the developer.
Security reasons or legal tension?
Mullenweg defends ACF’s move to WordPress.org within the framework of the platform’s “plugin library guidelines” rules. These rules include WordPress’ right to modify or discontinue plugins, if necessary, without the developer’s permission. However, WP Engine stated that such interference had never happened before and was unacceptable. The company described Mullenweg’s moves targeting WP Engine as a campaign to protect Automattic’s business interests.
Recently, WP Engine filed a lawsuit against Mullenweg and Automattic in the USA. The company claims that WordPress abuses its cooperation with commercial structures and that interventions on ACF are aimed at inhibiting competition. He also claimed that Mullenweg demanded royalties from the company of 8% of his monthly income. WP Engine claims that although they contribute to the WordPress ecosystem, such intervention harms the functioning of the industry.
The plugin, which will go by the name Secure Custom Fields, may require some additional steps for existing users. WP Engine has announced that premium users, especially ACF Pro and Flywheel, will need to manually update to continue using the original version. Otherwise, they will have to take advantage of the limited functionality offered through Secure Custom Fields. This could result in a complex transition process for ACF users and creates uncertainty about whether similar interventions will occur in the WordPress ecosystem in the future.
These developments bring about a broader discussion about the power dynamics within WordPress’s open source community. Users and developers are closely monitoring which way WordPress will move in the balance between central decisions and commercial interests. On the other hand, this indicates that the tension between Automattic and WP Engine will not end in the short term.