What’s the story
WordPress has officially acquired the Advanced Custom Fields (ACF) plugin, which was previously owned by WP Engine.
The news was shared by Matt Mullenweg, co-founder of WordPress and CEO of Automattic.
The rebranded version of the plugin will be called “Secure Custom Fields.” Mullenweg said the main objectives behind this move are “to remove commercial upsells and fix a security problem.”
Security concerns and legal disputes surround acquisition
The exact security issue that led to the takeover has not been disclosed by Mullenweg.
He referred to clause 18 of the plugin directory guidelines, which allows WordPress to edit or remove a plugin without developer’s consent.
This move is said to be related to a recent lawsuit against Mullenweg and Automattic by WP Engine.
The ACF team responded saying WordPress has never “unilaterally and forcibly” taken a plugin from its creator without consent in its 21-year history.
ACF team alleges violation of community promise
The ACF team has called the incident a breach of an “essential community promise.” They have urged others to think about the ethics of such an act.
Mullenweg admitted that similar situations took place before, but stressed that this case is “rare and unusual” because of WP Engine’s legal actions.
He added, “We do not anticipate this happening for other plugins.”
WP Engine provides update instructions for ACF users
In light of the ongoing dispute, WP Engine has released guidelines for users wanting to continue receiving updates for ACF.
They clarified that those who aren’t customers of WP Engine, Flywheel, or ACF Pro will have to follow steps published earlier for a one-time download of version 6.3.8.
This way, existing users can still access and use the plugin despite the change in management.
Mullenweg criticizes WP Engine and invites developers
Mullenweg has previously slammed WP Engine in a blog post, calling it a “cancer to WordPress.” He raised concerns over WP Engine’s lack of support for revision history, and its branding confusion with WordPress.
After these disputes, WordPress banned WP Engine from accessing WordPress.org, stopping them from updating the plugin through the platform.
Despite all this, Mullenweg said Secure Custom Fields will be available as non-commercial plugin and invited developers interested in maintaining and improving it to get in touch.
