Skip to content
DSRPT
Sep 24, 2026 · 8 min read

Automattic ousted Mullenweg for 33 hours. Is WordPress safe?

On 9 September 2026 Automattic's board put Matt Mullenweg on leave and named CFO Mark Davies interim CEO. Mullenweg controls most of the company's votes, so 33 hours and 20 minutes later he was back, the board was gone, and the two executives who ran the company in his absence had walked out with severance deals worth about $8.15 million. Your WordPress site is fine. What the episode exposes is how much of WordPress depends on one person.

Abdulkader Safi
Abdulkader Safi Senior Software Engineer
Share:
Automattic ousted Mullenweg for 33 hours. Is WordPress safe?

A board tried to fire a founder who controls 84% of the votes. That's the whole story, really. Everything else is detail.

The detail is still worth knowing, though, because WordPress runs about 41.9% of the web, and that almost certainly includes some of your sites. We look after client sites built on WordPress, and I've built a tool that ports WordPress sites to other stacks, so the question clients will ask is simple: should I worry? Here's what happened, and the short answer to that.

What happened, in order

Mullenweg co-founded WordPress in 2003 and started Automattic, the company behind WordPress.com, WooCommerce and Tumblr, in 2005. For two years he's been in an ugly legal war with WP Engine, a big WordPress host owned by the private equity firm Silver Lake. Here's how September played out:

  1. 9 September. He gets a board resolution 50 minutes before the meeting that will vote on it. He asks for time for his lawyer to read it. The board says no. Davies, retired four-star general Ann Dunwoody, Sue Decker and Toni Schneider (Automattic's first CEO, hired by Mullenweg himself) vote to put him on paid leave. Davies becomes interim CEO. The official line: "Matt Mullenweg is currently on leave from Automattic."
  2. 10 September. Mullenweg posts on X that he needs "great sysadmin and security researchers to hire really quick, no one from @automattic" to "move some of my stuff currently hosted there, elsewhere." On the same day, Davies and chief legal officer Andy Missan sign matching severance agreements.
  3. 11 September. Early Friday morning, in the company Slack: "Happy to announce the board is back in agreement, and I'm in control of Automattic." Then, on X: "If you don't have a coup attempt every few years, you're not hiring strong enough leaders." Asked if he's trolling, he tells TechCrunch: "I'm not a troll I'm a pirate, obviously."
  4. 12 September. Automattic confirms it. He "was away for only 33 hours and 20 minutes."
  5. 14 September. Sources tell TechCrunch that Schneider and Sue Decker have resigned, Dunwoody has been removed, and Davies and Missan have been let go.

Somewhere in the middle, a man who says he hadn't sworn in 42 years wrote in Slack, "since I'm a pirate now, I fucking curse," and said the company Slack "smells funny, like turncoats." A pirate flag emoji showed up next to his name in the WordPress Slack. Staff waiting for an explanation got a blog post about him trying to buy a houseboat.

Why the board thought it could win

The board never said why it acted. The best guess comes from the WP Engine case.

In a motion filed on 28 July 2026, WP Engine accused Automattic and Mullenweg of losing evidence. Court filings describe disappearing Signal and WhatsApp messages that weren't captured in time, a first attempt to image his phone in April 2025 that failed after an iOS update, and missing devices: a Pixel Fold and an iPhone that were lost before being imaged, and a MacBook nobody can locate. His phone wasn't successfully imaged until March 2026, about 20 months after the duty to preserve evidence began. A sanctions hearing is set for 30 September before Magistrate Judge Ajay Krishnan, and the trial is booked for October 2027.

So one theory is simple. Remove the person accused of losing evidence, and the company might look better in front of a judge. Mullenweg's theory is different. He hinted that Silver Lake had a hand in it.

Why he was always going to win

Voting power. At TechCrunch Disrupt in October 2024, Mullenweg said he held 84% of Automattic's voting power. During the ouster, someone on Reddit asked about replacing the board. His reply: "I can fill seats on the board whenever I want, but that's not the point."

It was exactly the point. A board sits above the CEO. A shareholder with 84% of the votes sits above the board. The board could vote him out, and he could replace the board with people who would vote him straight back in. That's roughly what happened.

The $8.15 million exit

This is the part I'd want a lawyer to explain slowly.

While Mullenweg was out, Davies and Missan, the two executives running the company, signed each other's severance deals. If fired, each got 12 months of base salary as a lump sum, accelerated vesting on their equity, the right to exercise vested options, and another year of health cover. Mullenweg came back and fired them. The combined bill is about $8.15 million.

Automattic has hired the law firm Susman Godfrey and is deciding whether to pay or challenge the deals in court. Good work if you can get it.

What this means if your business runs on WordPress

Short version: your site isn't going anywhere. WordPress is open-source software under the GPL. A fight over who runs Automattic doesn't switch off a self-hosted site in Kuwait or Adelaide.

The longer version is about WordPress.org. It's owned by Mullenweg personally, separate from Automattic. It hosts the plugin directory, the theme directory and the update servers that nearly every WordPress install talks to. When he tweeted about moving "my stuff" off Automattic's servers, most readers took it to mean WordPress.org.

We've already seen what happens when that power gets used in a fight. In September 2024, WordPress.org blocked WP Engine from its servers, and WP Engine customers briefly couldn't update plugins through the normal channel. A few weeks later the popular Advanced Custom Fields plugin was taken over and relaunched as "Secure Custom Fields." A US court later ordered Automattic to restore WP Engine's access. None of that was a technical failure. It was one person's decision, shipped straight into millions of sites.

The WordPress team says nothing has changed: Mary Hubbard, WordPress's executive director, said Mullenweg "continues to lead our project." Fine. But it's worth planning as if the next fight could reach you. Here's what I'd check this week:

  • Know who hosts you. WordPress.com, WP Engine, a managed host, your own VPS. Each one sits in a different spot in this fight.
  • Keep off-site backups of files and the database, and test a restore at least once. A backup you've never restored is a guess.
  • List every plugin and where its updates come from. Paid plugins often update from their vendor, free ones from WordPress.org.
  • Delete plugins you don't use. Fewer plugins means fewer things that can break when a directory changes hands.
  • Pin your WordPress and plugin versions on staging, test updates there, then push to live.
  • Write down your exit plan, even if it's one page: where you'd move, what it would cost, and how you'd keep your search rankings.

If that last item worries you, our write-up on choosing the right CMS in Kuwait walks through custom versus off-the-shelf. For online stores specifically, see Shopify, WooCommerce or custom for GCC ecommerce.

Should you leave WordPress?

Not because of this. WordPress share has slipped, from 43.6% in June 2025 to 41.9% in May 2026 according to W3Techs, and The Register points out the drop started around the time the WP Engine fight did. It also says plainly that the data shows correlation, and there's no evidence yet of people leaving over the drama.

Leave when the platform stops fitting the business. Slow pages, security upkeep eating your budget, plugin bills that keep climbing, features you keep hacking in. Those are real reasons. A founder calling himself a pirate is entertainment.

If you want alternatives on the table, we've looked at Cloudflare's EmDash and whether it replaces WordPress. And if "open source" still feels fuzzy, what open-source software is and why you should care explains why nobody can take your copy of WordPress away from you.

What to do now

Open your WordPress admin, go to Plugins, and count them. Then answer three questions: who hosts this site, when was the last backup restored, and where would you go if you had to move next month. If you can't answer the last one, that's your job this quarter.

My view: WordPress is still a sensible choice for most content sites, and the software will outlive this. But a platform where one person owns the update servers and 84% of the parent company's votes is a platform with one point of failure. Plan for it like you'd plan for any other. If you'd like a second pair of eyes on your setup, talk to the dsrpt team.

Frequently asked questions

Why was Matt Mullenweg removed as CEO of Automattic?

The board never gave a public reason. On 9 September 2026 it voted to put him on paid leave and made CFO Mark Davies interim CEO. Most reporting links the move to Automattic's lawsuit with WP Engine, where WP Engine accuses Mullenweg and Automattic of losing evidence, including disappearing Signal and WhatsApp messages and several lost devices. Mullenweg himself blamed the board and, indirectly, Silver Lake, the private equity firm that owns WP Engine.

How did Matt Mullenweg get back in control of Automattic?

He controls most of the votes. Mullenweg said in October 2024 that he holds 84% of Automattic's voting power, and during the ouster he wrote on Reddit that he could fill board seats whenever he wanted. Within 33 hours and 20 minutes he announced he was back in control. Board members Toni Schneider and Sue Decker then left, Ann Dunwoody was reported removed, and Davies and chief legal officer Andy Missan were let go.

Is WordPress safe to use after the Automattic coup?

Your WordPress site keeps working. The software is open source under the GPL, and a boardroom fight at Automattic does not switch off self-hosted sites. The real risk sits in wordpress.org, which Mullenweg owns personally and which serves plugins, themes and security updates to almost every install. Keep good backups, know where your updates come from, and have a documented plan for moving hosts or stacks if you ever need to.

What is the difference between WordPress.com, WordPress.org and Automattic?

WordPress is free open-source software. WordPress.org is the project's home: the download, the plugin and theme directories, and the update servers, and Mullenweg owns it personally. Automattic is his company. It runs WordPress.com (paid hosting), WooCommerce, Tumblr and other products. The coup was about who runs Automattic, but because one person sits at the top of both, trouble at the company can spill into the project.

Who got the $8.15 million severance from Automattic?

Interim CEO Mark Davies and chief legal officer Andy Missan. On 10 September 2026, while Mullenweg was on leave, the two signed matching severance deals: 12 months of base salary as a lump sum, accelerated vesting of their equity, the right to exercise vested options and a year of health cover. Mullenweg fired both when he returned. The combined bill is about $8.15 million, and Automattic has hired Susman Godfrey to decide whether to pay or challenge the deals.

Should I move my business website off WordPress?

Not because of this story alone. WordPress still runs about 41.9% of all websites, and a move costs real money and risks your search rankings if it's done carelessly. Move when the platform stops fitting what your business needs: speed, security upkeep, custom features, or plugin costs that keep climbing. If you do move, measure the old site and rebuild it page by page so nothing gets lost.

Sources

NEWSLETTER

Stay Ahead of the Curve

Get the latest digital marketing insights delivered to your inbox weekly.