Matt Mullenweg Declared War on WP Engine. Your Site Is the Battlefield.

In September 2024, Automattic CEO Matt Mullenweg published a post calling WP Engine a "cancer to WordPress." He meant it literally. Within days, Automattic blocked WP Engine from accessing WordPress.org — cutting off plugin updates, security patches, and theme downloads for the hundreds of thousands of sites WP Engine hosts.

WP Engine filed a lawsuit in October 2024, alleging defamation, abuse of market power, and interference with business contracts. A federal court issued a preliminary injunction in December 2024, forcing Automattic to restore WP Engine's access. The case continued into 2025: a judge dismissed antitrust and extortion counts in September 2025 but allowed defamation and interference claims to proceed. Automattic filed counterclaims in October 2025, citing WP Engine's parent company, private equity firm Silver Lake, as a driving force behind what Automattic characterized as deliberate trademark exploitation.

The Internal Collapse

The public dispute triggered significant internal damage at Automattic. In October 2024, Mullenweg offered employees buyout packages for those who disagreed with his direction. 177 employees accepted — roughly 10% of the company's workforce. In January 2025, he deactivated the WordPress.org accounts of five prominent community contributors, including Joost de Valk, the founder of Yoast SEO, after accusing them of organizing a fork of WordPress.

Perhaps the most consequential number: Automattic announced it was cutting its open-source WordPress contribution from approximately 3,988 hours per week down to 45 hours per week. That is a 98.9% reduction. The community interpreted this as retaliation. Automattic called it a reallocation of resources.

What This Means for Store Owners

WP Engine is a managed WordPress host used by a significant portion of serious WooCommerce stores. During the period when Automattic blocked its access to WordPress.org, WP Engine customers could not receive automatic plugin updates through standard WordPress channels. Security patches for actively exploited vulnerabilities were delayed. Real sites faced real exposure.

The deeper problem is structural. WordPress presents itself as an open-source platform that no single entity controls. The dispute revealed that WordPress.org — the central repository for plugins, themes, and core downloads — is effectively controlled by Automattic, a private company. The "open" layer has a chokepoint, and that chokepoint has a name.