WordPress.org's latest move involves taking control of a WP Engine plugin

Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use.

> Going forward, Secure Custom Fields is now a non-commercial plugin

Does this imply that Wordpress is potentially going after a revenue stream from WPEngine?

If the plugin had Pro options* then are those closed source and so not available to Wordpress in their fork of the codebase? It's not clear.

* https://www.advancedcustomfields.com/pro/

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#7

Post by shdon » Sun, Oct 13, 2024, 8:26 AM UTC

Mullenweg calls it a fork. I could see that being somewhat okay if it's indeed for security fixes, but removing the upsells is petty at the very least. But a fork doesn't take control of the original, so I wonder what they did there? Perhaps a redirect from the ACF entry to SCF?

To be honest, none of this makes WordPress look good... It just seems like a douche move.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#8

Post by withinboredom » Sun, Oct 13, 2024, 8:26 AM UTC

sureIy wrote: post #5

withinboredom wrote: post #2

They either have some of the best or worst legal counsel; or they just ignore the legal counsel.

Some people just think they're above the law. This Matt guy has gone mental.

Yeah, but pretty sure some of the employees/volunteers are in on it or "just following orders."

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#9

Post by aeurielesn » Sun, Oct 13, 2024, 8:38 AM UTC

vintagedave wrote: post #6

> It’s not clear what security problem Mullenweg is referring to in the post. Where is the CVE? What risk is there continuing to use the original plugin? No details at all. This results in fear: we don't know if the original is safe to use. > Going forward, Secure Custom Fields is now a non-commercial plugin Does this imply that Wordpress is potentially going after a revenue stream from WPEngine? If the plugin had Pr…

My understanding is ACF injected notices for their personal legal gains on everyone's dashboards. I wouldn't be surprised if such thing is a breach.

Re: WordPress.org's latest move involves taking control of a WP Engine plugin

#10

Post by sccxy » Sun, Oct 13, 2024, 8:39 AM UTC

Mullenweg is hijacking existing users with supply chain attack.