Your WordPress Site Doesn’t Care Who Runs Automattic

Updated September 14, 2026: Mullenweg is back as CEO and the directors behind his leave are out. The first version of this post ran the morning of the 14th, before the dust settled.

If you half-follow tech news, you probably saw the headline: Automattic’s board put CEO and WordPress co-founder Matt Mullenweg on leave, he was back 33 hours later, and the board that tried to sideline him was gone.

I’ve been the guy grumbling about WordPress governance in reply threads for two years, and the news still landed weird. I wrote the first version of this post before the reversal, and it aged in about a day.

So, what actually happened?

On September 9, Automattic’s board voted to place Mullenweg on paid leave. He called the leave involuntary, and CFO Mark Davies stepped in as interim CEO, according to TechCrunch.

Automattic is the private company behind WordPress.com, WooCommerce, Jetpack, Tumblr, and a pile of other products. It is deeply tangled up with the WordPress project, but it is not WordPress itself.

Then everything reversed.

On September 11, Mullenweg told staff in Slack that he was “back in control.” He said the four directors who approved the leave conspired behind his back, gave him 50 minutes’ notice, and did so over his vote against it.

On September 12, Automattic formally confirmed that Mullenweg was chairman and CEO “with the full support of the board,” roughly 33 hours after he was sidelined.

By September 14, TechCrunch reported that Davies, Ann Dunwoody, Toni Schneider, and Sue Decker had voted for the leave. Schneider resigned, while Mullenweg removed Dunwoody and Decker. The current board roster has not been reported.

No public reason was given for the leave. Automattic gave no reason for the reversal, either.

Meanwhile, the WordPress 7.2 release squad was announced, with Mullenweg listed as release lead. Mary Hubbard, executive director of WordPress.org, said the project “was not impacted” and that Mullenweg remained its leader.

Benched at the company for a day and a half. Still running the project the whole time.

Sit with that one for a second.

Your site is not an Automattic product

WordPress, the software installed on your hosting account, is open source under the GPL. It lives on your server, not inside Automattic’s office.

Automattic could vanish tomorrow and your website would still load on Tuesday. Some connected services might eventually need replacements, but the software doesn’t have a corporate kill switch.

WordPress also powers about 40.3% of all websites. Nothing that damn big turns off because of one boardroom vote.

Then there’s the trademark. The nonprofit WordPress Foundation owns it, while Automattic holds the exclusive license for commercial use, as explained in the Foundation’s trademark policy. That licensing arrangement became part of the legal backbone of Automattic’s fight with WP Engine.

But WordPress.org is a different beast.

That’s where nearly every WordPress site gets core, plugin, and theme updates. It isn’t owned by the Foundation. It is effectively Mullenweg’s personal site, with project governance informally tied to him and Automattic. There is no elected board overseeing it.

That was the one thing that worries me when I wrote about WordPress back in July.

This week made it more urgent.

Why I’m not exactly clutching my pearls

I haven’t been a fan of how this structure has been used, especially since the WP Engine fight began in 2024.

There were cease-and-desist letters in September. WordPress.org cut off WP Engine’s access to plugin updates later that month. WP Engine sued in October, and a court injunction restored access in December. The case is still grinding along in 2026, with no trial date. Automattic keeps its own running collection of posts about the dispute, too.

For me, crashing a plugin repository into a business dispute was the moment the governance problem stopped feeling theoretical. The repository is infrastructure for millions of site owners who had nothing to do with that fight.

So, was the leave good news?

The board tried to check the founder. Within two days, the founder was back and the directors behind the attempt were out or removed, as far as the reporting establishes.

Whatever you think of the attempt, the outcome leaves Mullenweg more firmly in control than before, at both the company and the project. With no public explanation for either decision, we’re left evaluating the structure rather than pretending we know the motives.

The fix I described in July was putting WordPress.org under an independent board or nonprofit, with clear rules and accountability that don’t depend on one person’s judgment. This week made that need harder to dismiss.

This isn’t about declaring someone a villain. It’s about fixing a structure that asks everyone to trust too much informal authority.

What changes for your site this week?

Nothing.

Your website works. Updates are flowing. Your hosting company doesn’t care who occupies Automattic’s CEO chair.

This week proved the company can change hands twice in 33 hours and your site won’t notice, which is exactly the point.

The asterisk is that plugin distribution still runs through one person’s website. As a business owner, your practical defense is an operator who noticed that dependency and planned around it.

That means real backups stored outside your website. It means keeping copies of premium plugins you paid for. It means someone whose job it is to watch updates, test them, and avoid clicking “update all” at midnight because the dashboard showed an angry red number. (We’ve all been the cobbler’s kid somewhere.)

There is encouraging news here. Starting this week, every plugin and theme release on WordPress.org gets a six-hour cooldown while AI models and Jetpack Scan assess it. High-risk releases can be blocked before reaching everybody’s dashboards.

That’s genuinely good. I’m glad the smart eggs working on repository security shipped it.

But a safer distribution system doesn’t patch your website for you. As I wrote this week, AI finds holes faster than sites get patched. Somebody still needs to pay attention, test the update, and keep grinding through the unglamorous maintenance work.

I ended my July post saying I was still building on WordPress, asterisk and all.

I still am. The asterisk got more interesting, then more interesting again, in the span of a week.

Keep building.