Automattic board ousts WordPress chief Matt Mullenweg, who then claims he's back 'in control'; WordPress.org adds AI-powered gate blocking risky plugin releases

Automattic's board voted WordPress co-founder Matt Mullenweg onto paid leave and named CFO Mark Davies interim CEO; less than 48 hours later Mullenweg claimed via Slack he was back in control, which Automattic has not confirmed. Separately, WordPress.org now…

Automattic — parent company of WordPress, Tumblr, WooCommerce and Pocket Casts — was plunged into leadership turmoil in early September 2026 when its board voted to place co-founder and CEO Matt Mullenweg on paid leave against his will, appointing CFO Mark Davies interim CEO while Mullenweg remained on the board (reported September 8–9, 2026). Mullenweg said he voted against the resolution, that the move was made 'behind his back,' and that he was denied time to have it reviewed by independent legal counsel; Davies told employees nothing will change. The vote followed years of turmoil including a protracted legal battle with WP Engine, a 2024 ultimatum in which 159 employees took severance, and a 16% staff layoff in April 2025. On Friday, September 11, 2026 — less than 48 hours after the leave was announced — Mullenweg posted in company-wide Slack that the board was 'back in agreement' and that he was in control; employee sources said Davies' Slack account was deactivated and that Mullenweg removed Slack admins. Mullenweg has suggested Silver Lake, majority owner of WP Engine (which is suing Mullenweg and Automattic), was involved in the ouster, but Automattic had not formally confirmed his claim, the board communicated nothing beyond Wednesday's Slack message, and the situation remains fluid; Mullenweg's follow-up blog post addressed buying a tugboat. WordPress.org's executive director said the open-source WordPress project and its teams continue as planned and are not impacted. Separately, WordPress.org has added a supply-chain gate: since June 5, 2026, every plugin and theme release passes an automated security review with a risk score during a six-hour cooldown (covering one-click dashboard updates), combining multiple AI models and Jetpack Scan to cross-check changes and reduce false positives; releases above the threshold are automatically blocked from the WordPress.org update API. Sources tie the change to a July 28, 2026 incident in which a backdoor was committed to a release of a plugin with roughly 20,000 active installations — the release was withheld and the plugin closed for downloads 26 minutes after Wordfence notified the Plugins Team, so the backdoor never reached users — though the cooldown is stated to have been in effect since June 5, 2026, before that incident. Blocked authors are emailed findings and can publish a corrected release scoring below the threshold or appeal to the Plugins Team, with publishing a fix usually faster; scores…

• Automattic's board voted to place co-founder and CEO Matt Mullenweg on paid leave (reported September 8–9, 2026); Mullenweg says he voted against it and was denied time to have the resolution reviewed by independent legal counsel.
• CFO Mark Davies was appointed interim CEO; Mullenweg remains on the board, and Davies told employees nothing will change.
• Automattic owns WordPress, Tumblr and Pocket Casts; Hacker News also lists WooCommerce.
• Background includes a protracted legal battle with WP Engine, a 2024 ultimatum in which 159 employees took severance, and a 16% staff layoff in April 2025.
• Mullenweg has suggested Silver Lake — majority owner of WP Engine, which is suing Mullenweg and Automattic — was involved in the ouster; Automattic has not formally confirmed this.
• WordPress.org's executive director said the open-source WordPress project and its teams continue as planned and are not impacted.
• Since June 5, 2026, every WordPress.org plugin and theme release passes an automated security review with a risk score during a six-hour cooldown covering all releases including one-click dashboard updates; releases above the threshold are…
• The review combines multiple AI models and Jetpack Scan to cross-check release changes and reduce false positives; scores measure risk exposure, not developer intent.