WordPress and WP Engine: The Ongoing Dispute and What It Means for Security

The WordPress ecosystem, known for its flexibility and a vast library of plugins, has recently been rocked by a legal battle between Automattic, the company closely associated with WordPress, and WP Engine, one of its largest hosting partners. This dispute has raised concerns about the future of WordPress plugins and themes, the accessibility of important security updates, and the broader implications for site security across the millions of websites relying on the platform.

In September 2024, Matt Mullenweg, co-founder of WordPress and CEO of Automattic, publicly criticized WP Engine, alleging that the hosting company was misusing the WordPress trademark and not contributing enough to the open-source WordPress ecosystem. Following these remarks, WordPress.org restricted WP Engine’s access to certain resources on its platform, sparking a lawsuit from WP Engine. They accused Mullenweg and Automattic of unfair practices, libel, and extortion, citing significant harm to WP Engine’s reputation and operations.

As a result, WP Engine-hosted sites faced interruptions in accessing key WordPress resources, limiting their ability to keep plugins and themes updated. For WordPress users, especially those using WP Engine, this raised significant security concerns, as outdated plugins are one of the leading causes of security vulnerabilities in WordPress sites.

The dispute between Automattic and WP Engine has led to notable developments in plugin management on WordPress.org. For example, WordPress.org assumed control of WP Engine’s popular plugin, Advanced Custom Fields (ACF), and rebranded it as "Secure Custom Fields." Automattic cited security concerns and the presence of commercial upsells as the reasons for this takeover.

This move has raised questions among users about plugin continuity, support, and security, particularly for those who rely on WP Engine-hosted sites. Users of the original ACF plugin may have faced confusion over the forked version, potentially missing updates if they did not transition or implement alternative security measures.

With these developments, it’s more important than ever for WordPress users to prioritize site security:

Stay Informed: Follow official updates from both WordPress.org and your hosting provider to ensure you're aware of any changes or security risks.

Verify Plugin Updates: Confirm that your site's plugins, especially essential security plugins, are receiving regular updates and patches.

Backup Regularly: Regular backups are crucial in case of issues with plugins, updates, or compatibility. Having a recent backup can be a lifesaver if you need to restore your site to a secure version.

Evaluate Plugin Needs Carefully: Stick to reputable plugins, ideally with a high number of downloads and recent updates. Given the recent tensions, this is especially crucial for plugins once associated with WP Engine.

The last year has seen several critical vulnerabilities (CVEs) affecting WordPress, reinforcing the need for vigilance in applying security updates. Here are some notable ones:

CVE-2024-10687 – Plugin Vulnerability: The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery Upload, Vote, Sell via PayPal, Social Share Buttons plugin for WordPress is vulnerable to time-based SQL Injection via the collectedIds parameter in all versions up to, and including, 24.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2023-6933 – Core WordPress Issue: The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

For millions of sites worldwide, WordPress remains a go-to platform, thanks to its user-friendly setup and vast plugin ecosystem. However, as the recent Automattic and WP Engine dispute shows, changes within the WordPress ecosystem can have a direct impact on site security and the availability of critical updates. Staying proactive and informed, prioritizing updates, and making strategic choices about hosting and plugins can help protect your WordPress site from potential vulnerabilities.