Automattic Board Sidelines CEO Matt Mullenweg

Automattic's board of directors has placed CEO Matt Mullenweg on an involuntary paid leave of absence, appointing Chief Financial Officer Mark Davies as the interim chief executive. While the board expressed confidence in Davies, Mullenweg publicly opposed the decision, warning employees on social media of potential smear campaigns and indicating plans to hire system administrators and security researchers outside of Automattic to migrate his personal hosted assets.

For enterprise IT executives, however, this leadership shakeup does not resolve the underlying structural risks of the WordPress ecosystem. Mullenweg personally owns and controls WordPress.org, the independent entity that hosts the plugin and theme directories and distributes security patches. Because this pipeline remains entirely under his individual control, the corporate leadership change at Automattic does not alter who manages the distribution infrastructure for software that powers over 40 percent of the web.

This concentration of power became a major concern during Mullenweg's recent legal battle with hosting provider WP Engine. During that ongoing dispute, Mullenweg unilaterally blocked WP Engine from accessing WordPress.org resources, cutting off customer sites from critical updates. Industry analysts warn that as long as a single person holds unaccountable authority over this infrastructure without independent governance, enterprise risk teams must continue to treat the platform as a significant vendor hazard.

Security professionals note that swapping out a corporate executive does not eliminate the technical single point of failure. To make WordPress truly viable for risk-averse enterprise buyers, the ecosystem must establish a clear separation between corporate interests, community governance, and the core update infrastructure. Until such structural reforms occur, IT leaders should closely monitor whether this executive transition leads to stronger institutional oversight or simply perpetuates the existing operational vulnerabilities.