Matt Mullenweg is back as Automattic CEO, and this time it is on the record, not a Slack rumor. If you run WordPress sites, the governance drama is worth exactly one read-through, because the thing that actually changed under your site this month shipped quietly on wordpress.org the same day the board tried to remove him, and almost nobody covering the drama has mentioned it. I audit and repair WordPress sites for a living, so here is the confirmed timeline, the parts still unconfirmed, and the change I am actually adjusting for.
The confirmed timeline, and what is still only sourced
On Wednesday 9 September 2026, Automattic’s board voted to put Mullenweg on paid leave and named CFO Mark Davies interim CEO. On Thursday 11 September, Mullenweg told staff in Slack that he was back in control; this was the window the early headlines hedged with “apparently”, because at that point the only evidence was employee accounts. On Saturday 12 September, an Automattic spokesperson put it on the record: “Matt Mullenweg is the chairman and CEO of Automattic, with full support of the board.” A second statement the next day added that he “was away for only 33 hours and 20 minutes”.
Now the unconfirmed part, and it should be labelled as such. Multiple outlets report, from sources, that the CFO, the chief legal officer and board members are out following the failed removal. Automattic has declined to answer questions about who now sits on the board. Mullenweg’s claim that executives “conspired” is his quoted accusation, not an established finding. And notably, his own blog has published nothing about any of it, and wordpress.org/news carries no announcement. That silence is a fact of its own: the only official words are two spokesperson statements.
What WordPress.org actually shipped that week
On 9 September, the same day as the board vote, the plugins team published details of an automated security review system for plugin releases, and this is the piece with real consequences for site owners. Since 5 June 2026, every plugin and theme release has gone through a cooldown before it is distributed through the wordpress.org update API, including the one-click updates in your dashboard. The cooldown is currently six hours. During it, the release diff is analysed by several AI models plus Jetpack Scan, cross-checked into a risk score. Releases that score high are blocked automatically and every committer gets an email; the team is explicit that the score measures risk, not intent, and that false positives are “low, but not zero”.
This is the operational successor to the direction I covered in the WordPress core security initiative: security review moving from human-gated and occasional to automated and universal. For site owners the practical meaning is that a plugin update you are waiting on can now legitimately sit in a six-hour hold, and a blocked release is a signal worth respecting, not routing around by downloading a zip from the developer’s site.
What did not change for your WordPress site
Through the entire 33 hours, the parts of the project a site depends on kept running. The core release train continued, with WordPress 7.2 in progress on make.wordpress.org. The update API served updates on schedule, inside the same cooldown rules as before. Ecosystem projects kept shipping; the MCP adapter work I wrote about in the WordPress MCP server post did not pause to watch the boardroom. Whatever the governance fight resolves into, nothing in the infrastructure your site touches changed because of it.
That is also my answer to the “should I migrate off WordPress” messages this kind of week generates: no, and a panic migration is the one move here with a proven SEO cost. I have cleaned up after enough of them; pages not indexed after a WordPress migration is what that failure looks like.
What I would check on a client site this week
Three small things, none of them urgent. If an important plugin update seems stuck, check the plugin’s own changelog and trac before blaming your site; a six-hour cooldown or an automated block explains most of it now. If you receive a committer-style security email about a plugin you develop, read it, because that pipeline now emails on every high-score release. And treat any “WordPress is collapsing” pitch from an agency this month as the sales tactic it is. The governance question that matters, who is on Automattic’s board, is unanswered, and I will update this post when it is answered on the record rather than by sources.
Sources
- TechCrunch, board forces Mullenweg into leave of absence, Mullenweg tells staff he is back in control and Automattic confirms his return, for the dated timeline and both on-record statements
- The Repository, Mullenweg returns with full support of the board, for the unresolved board-composition question
- WordPress.org plugins team, automated security review for plugin releases, for the 5 June start date, the six-hour cooldown, the scoring and blocking behavior
- My own WordPress audit and recovery work for the migration warning and the update-hold guidance