Automattic Board Ousts Mullenweg, Who Days Later Claims He's 'In Control'; WordPress.org Rolls Out AI-Gated Plugin Security Review

Automattic's board placed founder-CEO Matt Mullenweg on paid leave and named CFO Mark Davies interim CEO, but two days later Mullenweg told staff he was back in control; separately, WordPress.org now automatically blocks high-risk plugin and theme releases…

Automattic's board voted on Wednesday, September 9, 2026 to place co-founder and CEO Matt Mullenweg on a paid leave of absence and appoint CFO Mark Davies interim CEO. Mullenweg, who says he voted against the resolution, claims the move was made 'behind his back' and that he was denied time to have it reviewed by independent legal counsel; he remains a board member, and Davies told employees nothing would change. The decision follows years of turmoil at the company — which owns WordPress, Tumblr, WooCommerce, and Pocket Casts — including a divisive legal battle with WP Engine, buyout offers, a 2024 ultimatum in which 159 employees took severance, and a 16% staff layoff in April 2025. WordPress.org's executive director said the open-source project and its teams continue as planned and are not impacted. Two days later, on Friday, September 11, Mullenweg posted in Automattic's Slack that the board was 'back in agreement' and that he was in control; employee sources said Davies' Slack account was deactivated and that Mullenweg removed Slack admins. Mullenweg has publicly suggested Silver Lake — WP Engine's majority owner, whose company is suing Mullenweg and Automattic — was involved in the ouster, a claim Automattic had not formally confirmed; the board has communicated nothing further to employees beyond the initial Slack message, and the situation remains fluid. Separately, the WordPress.org Official Plugin Repository Team has operated an automated security review since June 5, 2026: every plugin and theme release is held for a mandatory six-hour cooldown, during which multiple AI models and Jetpack Scan analyze the code changes and produce a consolidated security score, and releases scoring above the risk threshold are automatically blocked from the WordPress.org update API — including one-click dashboard updates. The gate was introduced after a July 28, 2026 incident in which a backdoor was committed to a release of a plugin with roughly 20,000 active installations; the release was withheld and the plugin was closed for downloads 26 minutes after Wordfence notified the team, before reaching users. Blocked authors receive findings by email and must publish a corrected release scoring below the threshold or appeal to the Plugins Team; the scores measure risk exposure rather than developer intent, and the team has asked authors to report false positives.

• Automattic's board voted to place co-founder and CEO Matt Mullenweg on a paid leave of absence; Mullenweg says he voted against it, that the move was made 'behind his back,' and that he was denied time for review by independent legal…
• CFO Mark Davies was appointed interim CEO; Mullenweg remains on the board, and Davies told employees nothing would change.
• The board vote was reported Wednesday, September 9, 2026; on Friday, September 11, Mullenweg posted in company Slack that the board was 'back in agreement' and that he was in control.
• Davies' Slack account was deactivated and Mullenweg removed Slack admins, per employee sources; the board has communicated nothing to employees beyond the initial Slack message.
• Mullenweg publicly suggested Silver Lake — majority owner of WP Engine, which is suing Mullenweg and Automattic — was involved in the ouster; Automattic had not formally confirmed the claim.
• Background turmoil includes the WP Engine legal fight, buyout offers, a 2024 severance ultimatum in which 159 employees left, and a 16% staff layoff in April 2025.
• Automattic owns WordPress, Tumblr, WooCommerce, and Pocket Casts; WordPress.org's executive director said the open-source project's operations are unaffected by the leadership change.
• Since June 5, 2026, every WordPress.org plugin and theme release undergoes a mandatory six-hour cooldown with automated security review by multiple AI models plus Jetpack Scan, producing a consolidated risk score.