WP Engine vs WordPress.org are embroiled in a legal conflict over disabled WordPress core features, raising questions about open-source principles and hosting provider control. Learn more about the impact on the WordPress ecosystem
In September 2024, a single conference talk pulled the WordPress world into a fight it still hasn’t finished. Matt Mullenweg, co-founder of WordPress and CEO of Automattic, stood on stage at WordCamp US and called the hosting company WP Engine a “cancer to WordPress.” Within days there were cease and desist letters, a public ban, a lawsuit, and one of the most contested plugin takeovers the project has ever seen. If you build sites for a living, this dispute is worth understanding, because it touches the trademark, the plugin directory, and the norms most of us quietly rely on.
This is a live legal matter with people on both sides who feel strongly. What follows is a neutral rundown of what happened and where things stand as of July 2026, not a verdict on who’s right.
Table of Contents
- Background of the Conflict
- WP Engine’s Allegations and Claims
- Automattic and Mullenweg’s Response
- Legal Implications and Concerns
- Impact on the WordPress Community
- Where the Case Stands Now
- Conclusion
Background of the Conflict
The trigger was contributions and money, not a hidden paywall. On September 20 and 21, 2024, Mullenweg argued that WP Engine profits heavily from WordPress while giving little back to the open-source project, and he criticized product choices like WP Engine disabling post revisions by default. He also raised WP Engine’s use of the “WP” and “WordPress” trademarks in its branding.
Things moved fast. On September 23, WP Engine sent Automattic a cease and desist letter, accusing Mullenweg of trying to extort tens of millions of dollars in trademark licensing fees and citing messages in which he allegedly threatened to go “nuclear.” Automattic sent its own cease and desist two days later, focused on trademark use. On September 25, WordPress.org blocked WP Engine from accessing the plugin and theme directories, which broke updates for WP Engine customers until a short reprieve was granted on September 27.
It helps to know who controls what here, because the parties are not interchangeable. Automattic is Mullenweg’s company. The WordPress Foundation holds the WordPress trademarks. WordPress.org, the site that serves plugin and theme updates to millions of installs, is controlled by Mullenweg personally. That concentration of control sits at the center of the dispute.
WP Engine’s Allegations and Claims
On October 2, 2024, WP Engine sued Automattic and Mullenweg in the U.S. District Court for the Northern District of California. The complaint alleged extortion, abuse of power, unfair competition, tortious interference with its customer contracts, and violations related to the WordPress trademark, and it argued that cutting off WordPress.org access harmed WP Engine’s customers who had nothing to do with the fight.
WP Engine’s core position is that WordPress is open-source software the whole ecosystem is free to build on, that its trademark use was fair use, and that Mullenweg used his control of WordPress.org to pressure the company into a payment it never owed.
Automattic and Mullenweg’s Response
Mullenweg and Automattic dismissed the claims as baseless. Their position is that WP Engine has for years benefited from the WordPress name and community while contributing far less than peers of its size, that the WordPress Foundation is entitled to protect its trademarks, and that WordPress.org is a resource Mullenweg funds and runs, not a public utility WP Engine is owed access to.
Then came the most disputed move of the whole saga. On October 12, 2024, WordPress.org took over WP Engine’s Advanced Custom Fields plugin, a hugely popular developer tool, and replaced the listing with an Automattic-maintained fork called Secure Custom Fields. Because the fork kept the same plugin slug and update channel, many existing ACF installs were switched over on their next update. Automattic framed it as a permitted fork done for user security; WP Engine and many developers called it a hostile takeover of software they didn’t control. Either way, it crossed a line the project had never crossed before, which is why it drew so much attention.
Legal Implications and Concerns
On December 10, 2024, the court sided with WP Engine on the immediate question. Judge Araceli Martinez-Olguin granted a preliminary injunction ordering Automattic and Mullenweg to restore WP Engine’s access to WordPress.org, restore its control of ACF, and remove the login checkbox that had required developers to declare whether they were affiliated with WP Engine. A preliminary injunction is not a final ruling on the merits; it holds the status quo while the case proceeds. Automattic complied.
The larger legal questions are still open, and they matter beyond these two companies. They include how far trademark rights in an open-source project reach, whether the person who controls critical infrastructure like a plugin directory can cut off a specific business, and where the line sits between defending a brand and interfering with a competitor’s contracts.
Impact on the WordPress Community
For everyone else building on WordPress, the practical worry isn’t which company wins. It’s the reminder that a lot of the ecosystem runs through infrastructure that one person controls. The ACF episode showed that a plugin’s update channel can change hands, and the access ban showed that hosting on the wrong provider can, at least briefly, break your updates through no fault of your own.
None of that means the sky is falling. WordPress is still open-source, you can still self-host, and the code you’ve shipped keeps running. But the dispute nudged a lot of developers to think harder about supply-chain trust: where your plugins update from, who maintains them, and whether you have a fallback if a source you depend on goes dark.
Where the Case Stands Now
As of July 2026, the preliminary injunction is still in force, so WP Engine’s access and its control of ACF remain restored while the lawsuit works through the courts. The court has let the bulk of WP Engine’s claims proceed, including intentional interference, unfair competition, and defamation. Automattic, the WordPress Foundation, and WooCommerce have filed counterclaims accusing WP Engine of trademark misuse and deceptive branding, so both sides now have live claims against each other.
The case has kept moving through amended complaints, discovery, and motions to dismiss heard in mid-2026, with a jury trial currently set for September 2027. In other words, there’s no final winner yet. Anyone telling you the whole thing is settled is getting ahead of the record.
Conclusion
Strip away the personalities and this fight is really about a hard question: what happens when one open-source project’s brand, its main plugin directory, and a for-profit company all run through the same hands. WP Engine won the early round with the injunction, but the merits haven’t been decided, and both sides have claims left to argue.
If you build on WordPress, you don’t need to pick a team. You do need to know how your stack depends on shared infrastructure, and to keep an eye on a case that could shape how hosts, plugin authors, and the trademark coexist for years. We’ll update this post as the ruling develops.
For primary sources and ongoing coverage, see TechCrunch, WP Tavern, and the court docket on CourtListener.