Automattic’s board tried and lost. Mullenweg’s back as CEO. Plus 7.2 squad, Grok malware find, and auto plugin security news.
This issue of WP More is brought to you by GoDaddy’s Airo for WordPress; build a fully functional WordPress website in minutes!
Hello WordPressers!
Welcome to this week’s WP More roundup. This is WP More newsletter issue 56, where you get curated news about WordPress and the WordPress community all in one place. Hi5 to the 87 WordPressers who joined us in the last 7 days! We are now 878!
Automattic’s board tried to remove Matt Mullenweg as CEO. He refused to leave. Thirty-three hours later the board was gone and Mullenweg was back. That story dominated the week, but WordPress 7.2 also named its release squad, a Grok bot caught live malware sitting in a 40,000-install plugin on WordPress.org, and the plugin directory added automated security reviews that can block bad updates before they ship.
In this Issue:
- The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.
- WordPress 7.2 Release Squad Is Here
- A Grok Bot Found Live Malware on WordPress.org During a Routine Check
- WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship
- WordPress Must Read
- On Other WordPress News
- From WordPress Community
The Automattic Board Tried to Oust Matt Mullenweg. It Didn’t Work.
On September 9, Automattic’s board voted to put Mullenweg on paid leave, naming CFO Mark Davies interim CEO. Mullenweg posted to company Slack that board members had “conspired” behind his back, that he received the resolution 50 minutes before the meeting, and that requests to consult a lawyer were denied.
What followed was 33 hours and 20 minutes of chaos. He declined to leave, removed Slack admins, posted “I’m a pirate now,” and swore for what he called the first time in 42 years. He posted a hiring call for sysadmins to move “my stuff” off Automattic servers, raising questions about WordPress.org, which he personally owns. By Friday he said he was back in control. Automattic confirmed it Saturday. Davies, CLO Andy Missan, Toni Schneider, and Sue Decker are all reported out. What triggered the original vote has not been explained.
Read the full blog on The Repository →
With the leadership drama still fresh, the WordPress 7.2 release squad was announced the same week, and Mullenweg himself is on it.
WordPress 7.2 Release Squad Is Here
The WordPress 7.2 release squad has been announced. Matt Mullenweg is Release Lead, with David Baumwald on coordination, George Mamadashvili and Peter Wilson as Tech Leads, and a full team covering triage, testing, and the Twenty Twenty-Seven default theme.
The structure follows the lean squad model in use since WordPress 6.7. Make Team Reps coordinate inside their teams rather than routing through a central group. Twenty Twenty-Seven has dedicated design and development leads, plus a mentor role built specifically to get new contributors into the default theme work. The release date is December 9, 2026, during State of the Word. If you weren’t selected, triage, bug scrubs, testing, and documentation are all still open for contribution throughout the cycle.
Read the full blog on Make WordPress Core →
While the 7.2 squad gets to work, a security story from the plugin directory showed just how fast a threat can move through WordPress.org.
Brought to you by GoDaddy
Don’t Choose Between AI Speed And Owning Your WordPress Website
Wix, Squarespace, Framer; they all have AI builders now. They are fast to launch and look decent on day one. The problems show up later. A plugin your client needs does not exist in their marketplace or you want to move your website and find out you can’t export it cleanly, or the feature you need is locked behind a plan upgrade.
GoDaddy’s Airo for WordPress builds on your actual WordPress website. The site it generates is a live WordPress installation: full wp-admin, 60,000+ plugins, WooCommerce, your data, your hosting. Other AI tools build you a site, then you need to go somewhere else for domains, payments, plugins. With Airo, it’s all in the same place.
The Airo AI handles the build. WordPress handles the rest.
A Grok Bot Found Live Malware on WordPress.org During a Routine Check
Austin Ginder at Anchor Hosting runs a morning Grok bot that reviews plugin diffs from the WP Beacon catalog. After two weeks of quiet, it flagged something: the tailwind.config.js file in instawp-connect had grown from 2.2 KB to 9.8 KB. The extra bytes contained a Node.js dropper pulling command-and-control IPs from Ethereum transactions, then decrypting and executing a remote payload.
The plugin has 40,000 active installs, but no one got hit. The attacker pushed to trunk rather than cutting a tagged release, which is what the update API actually serves. Wordfence showed zero hits overnight because the payload only runs during a Node build, not on PHP page loads. Ginder emailed the plugins team, who closed the listing that afternoon. Trunk was infected for about 23 hours before the author cleaned and restored it.
Read the full blog on Anchor Hosting →
That attack was caught by one developer’s morning routine. WordPress.org is now building the same kind of check into every plugin update before it ships.
WordPress.org Can Now Automatically Block High-Risk Plugin Updates Before They Ship
WordPress.org has added automated security reviews to every plugin release. New plugins get reviewed before listing, but every update after that used to ship without any scrutiny between commit and distribution. That gap is now closed.
Every release sits in a six-hour cooldown window while several AI models and Jetpack Scan analyze the changes, producing a risk score. High-risk releases are automatically blocked before they reach the WordPress.org update API. Committers get an email with the findings. A high score doesn’t mean malicious intent, since an accidental vulnerability can score as high as deliberate malware. The InstaWP Connect incident described above was the system’s first confirmed interception: the Plugins Team closed that plugin 26 minutes after Wordfence flagged it, and the compromised version never shipped. If it runs cleanly, the cooldown window may shrink over time.
Read the full report on The Repository →
WordPress Must Read
→ Sources Say Automattic’s Board Is Out After Failed Attempt to Oust CEO Matt Mullenweg (techcrunch.com) – Davies, Missan, and Schneider are all reported out after the board’s attempt to remove Mullenweg collapsed in under 34 hours.
→ How to Model Data You Need to Query in Modern WordPress (remkusdevries.com) – A practical breakdown of how to structure custom data in WordPress for clean, efficient querying without fighting the platform.
→ WordPress 7.2 Release Squad Announced With Matt Mullenweg Back as Release Lead (therepository.email) – The Repository’s full coverage of the 7.2 squad announcement, with context on what Mullenweg’s return as Release Lead means for the December cycle.
→ Matt Mullenweg Tells Automattic Staff He’s Back in Control After CEO Ouster (techcrunch.com) – TechCrunch’s reporting on the 48 hours from ousted to reinstated, including the Slack messages and the “pirate” moment.
→ Automattic Board Forces Matt Mullenweg on Leave, Names CFO Mark Davies as Interim CEO (therepository.email) – The Repository’s original breaking story on the board vote, Davies’s appointment, and what Mullenweg posted company-wide.
→ Automattic’s Board Forces CEO Matt Mullenweg Into Leave of Absence (techcrunch.com) – TechCrunch’s initial September 9 report on the board vote and the Slack messages that followed.
→ Automattic CEO Matt Mullenweg Placed on Leave (theverge.com) – The Verge’s coverage of the leave announcement and what it means for Automattic and WordPress.com.
→ Students Built 108 Websites in Two Weeks in Bangladesh (wordpress.org) – Students in Bangladesh built 108 WordPress sites in two weeks as part of a learning program tied to the WordPress Credits initiative.
On Other WordPress News
→ Bringing Four Flagship Budgets Into One View (make.wordpress.org) – The Community team consolidates budget reporting across four flagship WordCamp events for clearer oversight.
→ Monthly Education Buzz Report: August 2026 (make.wordpress.org) – The Community team’s monthly roundup on WordPress education programs and what moved in August.
→ WordPress 7.1.1 RC1 Is Now Available (make.wordpress.org) – The first release candidate for the 7.1.1 maintenance release is out and ready for testing.
→ Planning for the Accessibility Lab Plugin (make.wordpress.org) – The Accessibility team’s plans for a dedicated lab plugin to test and develop accessibility improvements.
→ Updating WordPress to Use Node.js 24 and npm 11 (make.wordpress.org) – WordPress core is moving to Node.js 24 and npm 11, with details on what developers need to know.
→ Proposal: WordCamp Education Sponsor Fund for Flagships (make.wordpress.org) – A proposal to create a dedicated sponsor fund for education programming at flagship WordCamp events.
→ Automattic Fires Back at WP Engine Customer Class Action, Claims Small Business Owners Caused Their Own Losses (therepository.email) – Automattic’s legal response to the WP Engine customer class action, arguing the plaintiffs’ losses were self-inflicted.
→ Automated Security Review for Plugin Releases (make.wordpress.org) – The official Make WordPress Plugins post on how the new automated review works, what triggers a block, and what plugin authors should do if a release is flagged.
→ Proposed Change: Requiring PHP 8.1 or Newer for WooCommerce 11.5 and Beyond (developer.woocommerce.com) – WooCommerce is proposing to drop PHP 7.4 support starting with version 11.5, requiring PHP 8.1 as the new minimum.
→ WordPress 7.1 Release Retrospective (make.wordpress.org) – The core team’s post-release look at what worked and what didn’t in the 7.1 cycle.
From WordPress Community
→ Why WebMCP Is Going to Be Big for WordPress, and How to Try It Today (linkedin.com) – Jamie Marsland on why WebMCP matters for WordPress developers and how to get started with it today.
→ CloudFest Americas Returns to Miami With More Space, an Agency Focus, and a New Name (therepository.email) – CloudFest Americas is back in Miami with a larger venue, a sharper agency focus, and a new name for the event.
→ LoopConf Postponed to June 2027 After Lead Sponsor Pulls Out Six Weeks Before the Event (therepository.email) – LoopConf is pushed to June 2027 after its lead sponsor withdrew six weeks out, leaving no time to find a replacement.
→ AI-Generated Websites vs. WordPress: An Honest Comparison From a WordPress Agency (webdevstudios.com) – WebDevStudios on where AI site builders actually stand versus WordPress for real client work.
→ Six Solutions for WordPress Plugin Distribution, Each With a Different Philosophy (deploytroy.org) – A side-by-side look at six approaches to distributing WordPress plugins, from the official directory to self-hosted and commercial options.
→ Chris Reynolds on Building Trust With Project Contracts for Reliable AI Development (wptavern.com) – WP Tavern’s podcast with Chris Reynolds on how project contracts make AI-assisted development more predictable.
→ Did WordPress Just Lose? (youtube.com) – A video essay on where WordPress stands as the web shifts around it.
→ Benefit of the Doubt (crossword.fm) – The latest Crossword podcast episode on WordPress and the broader open source community.
→ Full WordPress, Full Control: How Airo Builds on Open-Source Without the Lock-in (godaddy.com) – Unlike proprietary AI builders, Airo generates a live WordPress installation. Full plugin access, full data ownership, no platform cage.*
*Sponsored
Until Next Week
Mullenweg was gone for 33 hours and 20 minutes. The board that voted him out is now out themselves. Three of Automattic’s top executives are reportedly gone, and the composition of the new board is still unclear as of today.
What actually triggered the vote? And with Mullenweg now also serving as WordPress 7.2 Release Lead, does his return to full control accelerate the project or complicate it?
Hit reply with your take. If this issue was interesting, pass it along.
— Nishat, WP More
Follow → X.com | LinkedIn | BlueSky | Facebook
Join Our Community → Sub-Reddit | X Community
Leave a Reply