On September 9, 2026, the board of Automattic placed Matt Mullenweg — WordPress co-founder, project lead, and the person most synonymous with the platform — on paid leave. Mark Davies, the CFO, was named interim CEO. The official statement was three sentences long and clinically corporate. Within 48 hours, Mullenweg had locked the board out of the company Slack workspace, removed admins, and declared himself back in charge. By September 12, Automattic issued a second statement confirming he was indeed the chairman and CEO again, "with full support of the board." The tone of that second statement was noticeably different from the first — enough that people noticed.

If you run a WordPress site and you've been ignoring this as internal drama, you should stop ignoring it. A federal judge ruled on September 28 that WP Engine's antitrust claims against Automattic, WooCommerce, and Mullenweg personally will proceed to trial. The fallout from the last three weeks is not contained. It is accelerating.

What actually happened

The timeline is dense, so here is the compressed version. Mullenweg has been publicly feuding with WP Engine since at least 2024, when he accused the hosting company of profiting from the WordPress ecosystem without contributing enough back. The dispute escalated when Automattic blocked WP Engine from accessing WordPress.org, the open-source project's plugin and theme directory. WP Engine sued, alleging antitrust violations, interference with business relationships, and unfair competition.

Automattic countersued, claiming trademark infringement and false advertising. Then on September 9, the board moved against Mullenweg. The reasons were never made public. Mullenweg later claimed there was a conspiracy against him, and he was given fifty minutes' notice before the board meeting — his request for a delay so an attorney could review was denied.

What followed was less corporate governance and more a heist movie. Mullenweg retained access to the company's Slack, booted the new admins, posted that he was back, and rallied employee support on social media. Automatticians tweeted in his favor. Mullenweg amplified each one. The people who supported his ouster were drowned out. By Saturday, the board capitulated.

The antitrust ruling

The September 28 ruling from U.S. District Judge Araceli Martínez-Olguín is the real news for anyone who depends on WordPress. The judge denied motions to dismiss from Automattic, WooCommerce, and Mullenweg on the core antitrust claims. Specifically:

WP Engine's wins. The monopolization and attempted monopolization claims survived. So did both illegal tying claims — one federal, one under California law — which allege that Automattic used control over WordPress.org to pressure users away from WP Engine. The interference and unfair competition claims against WooCommerce also survived. The judge found that WP Engine had alleged enough specific conduct to proceed.

Automattic's wins. All seven of Automattic's counterclaims survived at least in part, including trademark infringement, dilution, false advertising, and unfair competition. WP Engine's computer extortion claim was dismissed.

Net result. Both sides have claims heading to trial. Neither side got a clean knockout. But the fact that the antitrust claims survived is significant — it means a federal judge looked at the allegations and concluded they are plausible enough to litigate.

Why this matters for your site

If you run WordPress on WP Engine, your hosting company is locked in a lawsuit with the entity that controls the open-source project your site depends on. If you run WordPress anywhere else, you are watching the platform's governance structure fracture in real time. The WordPress.org directory — the place where you get themes, plugins, and updates — is controlled by Automattic, and the court is now examining whether that control was used to punish a competitor.

Separately, WordPress announced a Core Security Initiative in late August, partly in response to AI-powered vulnerability discovery. The initiative has three parts: faster security releases, clearing the backlog of known issues, and using AI to find vulnerabilities before attackers do. That is the kind of proactive security work the platform needs. It is also happening while the company behind it is consumed by legal and leadership chaos.

What to do about it

Don't panic, but don't tune out either. If you are on WP Engine, your sites are fine for now — the lawsuit is about business practices, not infrastructure. If you are choosing a host, the lawsuit introduces a variable that was not there six months ago. Consider whether your hosting provider's relationship with the WordPress ecosystem is stable.

Keep your plugins updated. The security initiative is real, but its effectiveness depends on execution, and execution requires focus. Right now, Automattic's focus is divided.

And if you've been putting off evaluating alternatives — whether that's static site generators, headless WordPress, or a different CMS entirely — this is a reasonable time to revisit that conversation. Not because WordPress is dying. It isn't. But because the ecosystem around it is less predictable than it was a year ago, and predictability is worth something when your business depends on a website.

Sources