On September 24, 2026, a federal judge in California ruled that Automattic and its CEO, Matt Mullenweg, are “neither owners nor registrants of the marks at issue” in their trademark claims against WP Engine, and dismissed those claims “to the extent Mullenweg and Automattic purport to assert them in their own right.” 1 Source 1 Order Re Motions to Dismiss, WPEngine, Inc. v. Automattic Inc., No. 4:24-cv-06917-AMO (N.D. Cal.), Dkt. 410, September 24, 2026, Judge Araceli Martínez-Olguín. The conclusion: the trademark counterclaims (Counts 1, 3 to 5) “are DISMISSED to the extent Automattic and Mullenweg seek to assert those claims in their own right.” Copy on govinfo.gov. The same order let WP Engine’s antitrust claims go forward. A ten-day jury trial is set for October 19, 2027.
It settles less than the headlines suggest. The order is about who may sue over the WordPress name. The trademark claims carry on, and nothing in the order decides whether anyone did anything wrong. Search Engine Journal summed it up as handing “both WP Engine and the defendants significant victories and losses.”
What it leaves alone is the question a business running its site on WordPress actually depends on. In October 2024, WordPress.org replaced a plugin running on more than two million websites with its own fork and delivered it through automatic updates. Who controls that update channel, and what it’s allowed to do, hasn’t changed since. The answer is written down, though, and it belongs in your risk register.
Key facts
- Not owners of the marks. The court found Automattic and Mullenweg are “neither owners nor registrants of the marks at issue” and dismissed their trademark counterclaims as asserted in their own right. Source: Order Re Motions to Dismiss, WPEngine v. Automattic (N.D. Cal.), September 24, 2026.
- Antitrust claims revived. Four antitrust counts the same judge dismissed in September 2025 now proceed. WP Engine’s computer-extortion claim was dismissed for good. Source: the same order.
- Trial on October 19, 2027. Ten days, before a jury, with summary judgment briefing from November 20, 2026. Source: scheduling order, September 11, 2026; court order, November 4, 2026.
- Over two million websites. The court’s count of sites running Advanced Custom Fields when WordPress.org forked it on October 12, 2024. Sites with automatic plugin updates were switched without a click. Source: preliminary injunction order, December 10, 2024; WordPress.org, October 12, 2024.
- Guideline 18. WordPress.org’s plugin rules still reserve the right “to make changes to a plugin, without developer consent, in the interest of public safety.” Source: Detailed Plugin Guidelines, developer.wordpress.org, last updated March 11, 2026.
What did the court actually decide?
The order answers two motions to dismiss, one from each side, and each side lost something.
Automattic and Mullenweg asked the court to throw out WP Engine’s antitrust claims, as it had a year earlier. This time the judge reversed herself in a footnote: “The Court previously dismissed WPEngine’s antitrust claims and departs from its prior order, now finding WPEngine’s antitrust claims viable.” 2 Source 2 Same order, footnote 2. The earlier dismissal was the order of September 12, 2025 (Dkt. 169). WP Engine’s Computer Fraud and Abuse Act claim (Count 3) was “DISMISSED WITHOUT LEAVE TO AMEND, because the claim fails as a matter of law.” Both monopolization counts and both tying counts are back in the case. WP Engine’s claim that the licensing demand amounted to computer extortion went the other way. It’s gone for good, with the court repeating that “hard bargaining does not amount to extortion.”
WP Engine asked for the trademark counterclaims filed by Automattic, Mullenweg, WooCommerce and the WordPress Foundation in October 2025 to go. Most of them survive. Whether WP Engine’s use of the name was fair use, and whether the marks were famous when it started, are “factual issues not suitable for resolution at this stage.” The cut was narrower: Automattic and Mullenweg can’t bring those trademark claims themselves.
All of this happened at the pleading stage, where a judge takes the complaint’s allegations as true and asks only whether they’d state a claim if proved. 3 Editor's note 3 Why these are allegations, not findings: on a motion to dismiss, a court accepts the complaint’s allegations as true and asks only whether they would state a claim if proved. The order says so in its own words: “Taking these allegations as true and drawing all inferences in WPEngine’s favor.” A claim that survives can go to trial. It hasn’t been proved. That includes the allegation, summarized in the order, that “Defendants targeted multi-million-dollar deals with at least 11 competitors.” Automattic and Mullenweg deny wrongdoing. Nothing has been proved either way.
The next steps are already on the calendar. The defendants’ summary judgment motion is due November 20, and WP Engine’s combined brief on December 18. A magistrate judge heard WP Engine’s motion for sanctions over lost messages on October 7; the docket reads “Matter submitted; written order to follow,” and no order had appeared by November 10. 4 Source 4 Scheduling order, Dkt. 373, September 11, 2026: “Jury Trial (10 days)” on “October 19, 2027, at 8:30 a.m.” Order re summary judgment letter briefs, November 4, 2026: defendants’ opening brief due November 20, 2026, WP Engine’s combined brief due December 18, 2026. Minute entry, October 7, 2026, on WP Engine’s sanctions motion (Dkt. 357): “Matter submitted; written order to follow.” Docket read on CourtListener, entries through November 10, 2026.
The plugin takeover, two years on
The fight went public on September 21, 2024, when Mullenweg wrote of WP Engine, in a post on WordPress.org, that “they are a cancer to WordPress.” 5 Source 5 WordPress News, “WP Engine is not WordPress,” Matt Mullenweg, September 21, 2024: “This is one of the many reasons they are a cancer to WordPress.” The post followed his WordCamp US talk the day before. The block: TechCrunch, “WordPress.org bans WP Engine, blocks it from accessing its resources,” September 25, 2024. Four days later WordPress.org blocked WP Engine’s servers, and WP Engine’s customers could no longer install or update plugins from their dashboards.
On October 12, WordPress.org forked WP Engine’s Advanced Custom Fields plugin into one it named Secure Custom Fields, in the original’s place in the directory. Mullenweg’s announcement said the fork would “remove commercial upsells and fix a security problem,” and that “we do not anticipate this happening for other plugins.” It was also plain about what would happen to sites: “Where sites have chosen to have plugin auto-updates from WordPress.org enabled, this update process will auto-switch them from Advanced Custom Fields to Secure Custom Fields.” 6 Source 6 WordPress News, “Secure Custom Fields,” Matt Mullenweg, October 12, 2024. The post says the fork invokes “point 18 of the plugin directory guidelines.” The ACF team’s response is quoted from its October 12, 2024 post on X, as reproduced on WP Engine’s timeline page. The ACF team said a plugin under active development had never before been “unilaterally and forcibly taken away from its creator without consent.”
On December 10, 2024, the court granted WP Engine a preliminary injunction. It barred the defendants from “using auto-migrate or auto-update commands to delete, overwrite, disable, or modify any WPEngine plugin without the express request by or consent of WPEngine” or its customers. Explaining why the public interest favored it, the court counted over two million websites on the plugin and wrote that “preventing arbitrary disruption stemming from a corporate dispute is in the public interest.” 7 Source 7 Order re Motion for Preliminary Injunction, Dkt. 64, December 10, 2024: “Over two million websites run the ACF plugin Mullenweg allegedly tampered with.” The order also required access to wordpress.org to be restored as it existed on September 20, 2024.
That injunction protects WP Engine and its customers. It doesn’t touch the rule WordPress.org relied on, which is still published. Guideline 18 of the plugin directory reserves the right “to disable or remove any plugin from the directory, even for reasons not explicitly covered by the guidelines,” and “to make changes to a plugin, without developer consent, in the interest of public safety.” It promises to use those rights “sparingly.” 8 Source 8 WordPress.org Plugin Handbook, Detailed Plugin Guidelines, guideline 18: “We reserve the right to maintain the Plugin Directory to the best of our ability.” The same list reserves the right “to update these guidelines at any time.” Page last updated March 11, 2026; read November 14, 2026.
Who controls the update channel your site trusts?
The name and the distribution channel both get called WordPress, and they have different owners. The name belongs to the WordPress Foundation, which “owns and oversees the trademarks for the names and logos of WordPress.” The distribution channel, meaning the plugin directory and the update servers your site checks, runs on wordpress.org. In the 2024 injunction, the court summarized Mullenweg’s own declaration: he is “the individual owner of the domain name wordpress.org, the manager of the wordpress.org website, and a founding director of the WordPress Foundation.” 9 Source 9 WordPress Foundation, Trademark Policy, read November 14, 2026. Preliminary injunction order, Dkt. 64, December 10, 2024, summarizing Mullenweg’s declaration. The same passage records that “The foundation owns three WordPress trademarks.”
September’s ruling is about the name. The channel never came up.
This autumn also showed how little a change at Automattic reaches the project. On September 9, 2026, Automattic’s board voted to put Mullenweg on paid leave. In a message to the WordPress.org community that TechCrunch reported that day, the project’s executive director, Mary Hubbard, wrote: “Matt remains the leader of the WordPress project and I remain Executive Director of WordPress.” By September 12 Mullenweg was back as CEO, the directors involved soon resigned or were removed, and Automattic said he “was away for only 33 hours and 20 minutes.” 10 Source 10 TechCrunch, “Automattic’s board forces CEO Matt Mullenweg into leave of absence,” September 9, 2026, quoting Hubbard’s Slack message to the WordPress.org community; “Automattic confirms Mullenweg has returned as CEO after attempted ouster by board,” September 12, 2026, quoting Automattic’s statement; “Automattic has a new board after failed attempt to put CEO on leave,” September 25, 2026. Even while the company’s leadership was in question, the project’s leadership wasn’t. 11 Editor's note 11 This is our reading, not a reported finding. The board’s vote and its reversal concerned Automattic, the company. WordPress.org’s leadership said the project’s work was unaffected, and we know of no published process by which anyone outside wordpress.org’s own leadership sets the plugin directory’s rules.
A site that updates its plugins automatically is trusting whoever runs the channel, under rules the channel writes for itself and can change at any time.
Some people are trying to change that structure. In June 2025 the Linux Foundation launched a project to federate plugin distribution, saying it “Eliminates reliance on any single source for core updates, plugins, themes and translations.” 12 Source 12 Linux Foundation, “Linux Foundation Announces the FAIR Package Manager Project for Open Source Content Management System Stability,” June 6, 2025. We found no independent figure for how many sites use it. Whether anything like it sits between your site and wordpress.org is a question for your host. Don’t assume the answer.
What goes in the risk register
None of this makes WordPress unsafe software, and it isn’t an argument for leaving. WordPress runs 38.7% of all websites (W3Techs, November 2026), and the dispute’s direct effects landed on WP Engine’s customers and on sites running one plugin. The point is narrower. The frameworks risk teams already use define supply-chain risk as harm “posed by suppliers, their supply chains, and their products or services” (NIST SP 800-161). 13 Source 13 NIST SP 800-161 Rev. 1, Update 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, section 2.2. Its own examples include a supplier that plants a backdoor in its product, so the category exists in the framework. What’s usually missing is the register entry. Most WordPress sites have a supplier in that sense that never shows up in the register, because there’s no contract with it and no account manager to call.
Write it down as a dependency with an owner. A site that updates its plugins automatically is trusting whoever runs the channel, under rules the channel writes for itself and can change at any time. The entry should name wordpress.org as the source and note that its guidelines allow changes to a plugin without the developer’s consent. Add a date to watch, too: the dispute behind all this isn’t scheduled to reach a jury before October 2027.
Then set the auto-update policy on purpose, not by default. Automatic updates are also how security fixes reach you fast, and the WordPress ecosystem logged 11,334 new vulnerabilities in 2025 (Patchstack, 2026), so switching them off across the board trades a rare risk for a constant one. The ACF switch reached sites through that one setting. Know which plugins your business would break without, and have someone review changes to those before they go live.
Ask your host where your updates come from and what happens if that source is cut off. In 2024 WP Engine had its own update path running for its customers by October 1, less than a week after the block, according to WordPress.org’s own announcement. Your host’s answer tells you how long you’d wait.
Whatever platform a client was on, the clause they most needed to understand was usually the one about who could change the product under them, and on what notice. On the WordPress sites we review, the auto-update setting is rarely a decision anyone remembers making.
If you want to score this exposure alongside the other five factors, Factor 4 of our WordPress evaluation framework turns it into a number. A dependency you’ve named and scored is one you decide about on your own schedule, whatever the jury says in 2027.
The research is free. So is the diagnosis. 60 seconds →