3 ms·

The Tweets original content was[0]: > Automattic's security team has responsibly disclosed a vulnerability in @wp_acf to @wpengine. As is standard, they have 3

by flutas 2y ago

The Tweets original content was[0]: > Automattic's security team has responsibly disclosed a vulnerability in @wp_acf to @wpengine. As is standard, they have 30 days to issue a fix before public disclosure. We have reserved this CVE for the issue: https://www.cve.org/CVERecord?id=CVE-2024-9529 https://www.cve.org/CVERecord?id=CVE-2024-9529 Basically announcing to the world that there is a CVE in a very widely used ("2MM+ sites") WP plugin, that also can't be patched as they banned the developers accounts from updating said plugin[1]. [0]: https://imgur.com/a/wf73amz https://imgur.com/a/wf73amz [1]: https://wordpress.org/news/2024/09/wp-engine-banned/ https://wordpress.org/news/2024/09/wp-engine-banned/

paulryanrogers 2y ago
Perhaps Automattic's goal is to force WPEngine to host their plugin(s) elsewhere? And also force WPEngine to have their own plugin cache or plugin market? Or at least no longer rely on WordPress.org's plugin repo directly.
- flutas 2y ago
  WPEngine has already done both of those. Literally at this point the only customers this is hurting are standard WordPress users not on WPEngine.
- madeofpalk 2y ago
  Matt Mullenweg's explicit goal is for WP Engine to pay up. > “The analogy I made is they got Al Capone for taxes,” Mullenweg says. “So, if a company was making half a billion dollars from WordPress and contributing back about $100,000 a year, yes, I would be trying to get them to contribute more.” WP Engine competes directly with the hosting services offered by Automattic and WordPress.com, and Mullenweg argues one of the reasons for its success is the use of “WordPress” across its site. “That’s why we’re using that legal avenue to really, yeah, pressure them. That’s true: we are pressuring them.” > “I happily provide WordPress.org services to literally every other host,” Mullenweg says. There is “no requirement to give back. WordPress will be open-source forever and ever, and so there will never be any legal requirement to give back.” But WordPress does still “request” that companies contribute something. “It’s better for WordPress if they give back.” https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-w...

by flutas 2y ago

paulryanrogers 2y ago

Perhaps Automattic's goal is to force WPEngine to host their plugin(s) elsewhere? And also force WPEngine to have their own plugin cache or plugin market? Or at least no longer rely on WordPress.org's plugin repo directly.

flutas 2y ago
WPEngine has already done both of those. Literally at this point the only customers this is hurting are standard WordPress users not on WPEngine.
madeofpalk 2y ago
Matt Mullenweg's explicit goal is for WP Engine to pay up. > “The analogy I made is they got Al Capone for taxes,” Mullenweg says. “So, if a company was making half a billion dollars from WordPress and contributing back about $100,000 a year, yes, I would be trying to get them to contribute more.” WP Engine competes directly with the hosting services offered by Automattic and WordPress.com, and Mullenweg argues one of the reasons for its success is the use of “WordPress” across its site. “That’s why we’re using that legal avenue to really, yeah, pressure them. That’s true: we are pressuring them.” > “I happily provide WordPress.org services to literally every other host,” Mullenweg says. There is “no requirement to give back. WordPress will be open-source forever and ever, and so there will never be any legal requirement to give back.” But WordPress does still “request” that companies contribute something. “It’s better for WordPress if they give back.” https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-wordpress-org-wp-engine https://www.theverge.com/2024/10/4/24262232/matt-mullenweg-w...