Advisory: Advanced Custom Fields Changes  ## Metadata - Author: [[Tim Nash]] - Full Title: Advisory: Advanced Custom Fields Changes - Category: #articles - Document Note: --- tags: [#wordpress, #security, #plugin, #legaldispute] Author: Tim Nash Source: [Tim Nash’s Blog](https://timnash.co.uk) Reference: [Advisory: Advanced Custom Fields changes](https://timnash.co.uk/advisory-advanced-custom-fields-changes/) date created: 2024-10-14 11:15 --- # Title: Advisory on ACF Changes and Legal Risks ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: This advisory discusses how WordPress.org replaced Advanced Custom Fields (ACF) with Secure Custom Fields (SCF) following legal disputes with WP Engine. Although WP Engine maintains an alternative ACF version, Nash warns users about unexpected updates. Both SCF and ACF offer the same security patch, but governance questions remain unresolved. ## 📖 Main Content: WordPress.org pushed SCF, stripping ACF's branding and replacing it on the plugin repository without user notice. While WP Engine mirrors ACF independently, some users may encounter unintended updates to SCF. The article highlights governance issues within WordPress and provides recommendations to maintain ACF from WP Engine if desired. ### 🗒️ Notes: - **Update Impact**: ACF was replaced with SCF via automatic updates. - **Governance Issues**: Concerns over WordPress's unilateral decision-making. - **Security Patch**: Both SCF and ACF contain identical fixes, suggesting the change was not security-driven. ## 📖 References: - [Advisory on ACF Changes](https://timnash.co.uk/advisory-advanced-custom-fields-changes/) ## 🗣️ Paraphrase: 1. Tim Nash explains that SCF and ACF share the same security patch, raising questions about the necessity of WordPress’s intervention. 2. Users relying on WP Engine’s mirrored version of ACF must take extra steps to prevent unintentional upgrades to SCF. ## 📰 Newsletter: **Heads up!** If you're using Advanced Custom Fields (ACF), you might notice some changes—WordPress.org has replaced ACF with Secure Custom Fields (SCF) amid ongoing disputes with WP Engine. The plugins share identical security fixes, but governance questions are sparking debate. Get the full scoop, plus tips to manage plugin updates effectively, in this week’s newsletter! ## ✅ Action Items: - **Professional Alignment**: This issue reflects the importance of governance transparency, aligning with your open-source advocacy work. - **OSPO Goal**: Navigating these governance challenges builds essential knowledge for your future OSPO ambitions. ## 🧪 Hypotheses: - Frequent governance conflicts could drive developers to seek decentralized plugin platforms. - Similar incidents may result in increased user preference for direct vendor support. ### 📊 Methodology: - **Survey**: Collect feedback on plugin management practices from the WordPress community. - **Case Study**: Compare plugin governance models across other open-source ecosystems. ### ❓ Questions: - How can developers safeguard their plugins from unexpected governance actions? - What governance reforms could improve transparency in the WordPress ecosystem? ### 🔮 Future Research: - Assess how governance conflicts affect developer participation. - Explore how decentralized governance could prevent similar disputes. ### 💡 Implications: Governance improvements may strengthen developer trust and encourage long-term contributions to open-source projects. ### 🧠 Learning Styles Assessment: - **Visual Learners**: Include a visual timeline of the SCF update process. - **Logical Learners**: Add a side-by-side comparison of ACF and SCF updates. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: Ensure all plugin documentation is accessible. - **Keyboard Navigation**: Optimize plugin update workflows for accessibility. ### 🌍 DEIB Assessment: - **Inclusiveness**: Encourage inclusive decision-making in plugin governance. - **Psychological Safety**: Promote open dialogue among contributors regarding governance changes. ### ✅ Logical Validity: - **Strengths**: Nash provides clear evidence of identical security patches, questioning WordPress’s reasoning. - **Fallacies**: Some reliance on slippery slope concerns about future governance decisions. ### 🔍 SEO Evaluation: - **Keywords**: ACF plugin, Secure Custom Fields, WordPress governance. - **Optimization**: Link to plugin documentation for improved engagement. ## 🎯 Conclusion: The ACF to SCF transition raises critical concerns about governance and user trust within WordPress. As plugin management remains in flux, this case underscores the need for transparent decision-making processes to maintain community confidence. - Document Tags: [[acf]] [[matt mullenweg]] [[open source corporate contribution]] [[wpdrama]] [[wp engine]] - Summary: Advanced Custom Fields (ACF) is no longer on WordPress.org, sites running ACF. here is what you need to know and what actions to take. - URL: https://timnash.co.uk/advisory-advanced-custom-fields-changes/ *Note this is a modified slightly version of an email sent to all my existing retainer clients and past site review clients.* This update: * Renamed *Advanced Custom Fields* to *Secure Custom Fields* (SCF) * Modified the plugin’s branding * Removed WP Engine’s branding from view, altering code related to WP Engine service offerings. To clarify, *wordpressdotorg* is a legitimate admin account within the WordPress.org infrastructure. Shortly after this occurred, wordpress.org published a post about the change: [Secure Custom Fields Announcement](https://wordpress.org/news/2024/10/secure-custom-fields/) Unfortunately, some of the links in the post lead to 404 errors at the moment. The ACF team, issued a response, which you can read here: [ACF Blog Update](https://www.advancedcustomfields.com/blog/acf-plugin-no-longer-available-on-wordpress-org/) ##### What does this mean for you? If you’re using *ACF Pro*, **there’s no need to update** this post is just for your awareness. If you host on WP Engine, this change hasn’t impacted you, as they’ve been maintaining a mirror of the plugins repository. However, if you have automatic updates enabled, you might have noticed a surprise: *ACF* has already been replaced with *Secure Custom Fields* (SCF). For those of you who manually update, the version of *ACF* provided by WP Engine is still available for download directly from them. An update will show as being available for ACF in your wp-admin area, manually updating using this will result in you being upgraded to SCF. ###### To keep the ACF version from WP Engine In both cases, you’ll need to manually update to the latest version of the plugin. To assist you, here are some quick instructions: [Upgrading ACF using WP Engine repository](https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/). **For command line users**: Run the following command to install the latest version of ACF directly: ``` wp plugin install https://www.advancedcustomfields.com/latest/ --force ``` This will install and override the existing plugin. You only need to do this once; future updates from WP Engine will happen automatically/Be shown as available. ##### ACF vs SCF: Which one should you use? It’s important to note that *Secure Custom Fields* is **no more secure** than *ACF*. The security patch to fix a vulnerability found by Automattic last week was already applied by the WP Engine team prior to this incident, shared with the WordPress Security Team who had ALREADY patched ACF on wordpress.org. In the short term, neither party is likely to make drastic changes to avoid disrupting users. However, development at WP Engine may have slowed temporarily due to these events. For now, I would recommend sticking with the *ACF* version provided by WP Engine, it’s likely to be more stable and to receive timely security updates. Given that “security” is being used as part of a larger campaign, I would not be shocked if more small vulnerabilities are disclosed with patches applied to the WordPress.org SCF. I will review each vulnerability report for both *ACF* and *SCF*. If my findings, or the community’s, differ from the official reports, I will notify my clients. This will unfortunately I fear get messy for a while. I do remain confident that ACF will be maintained and managed. ##### Moving Forward At this stage, the future of these plugins remains uncertain. Both Automattic (owners of WordPress.com) and Matt Mullenweg (owner of wordpress.org site) are named parties in a legal dispute with WP Engine, and it’s unclear what long-term effects this will have. If you have any questions, I’ll do my best to answer them, though I may not have all the answers right now. Helping you and your customers stay safe #### WordPress Security Consulting Services Power Hour Consulting Want to get expert advice on your site's security? Whether you're dealing with a hacked site or looking to future-proof your security, Tim will provide personalised guidance and answer any questions you may have. A power hour call is an ideal starting place for a project or a way to break deadlocks in complex problems. Site Reviews Want to feel confident about your site's security and performance? A website review from Tim has got you covered. Using a powerful combination of automated and manual testing to analyse your site for any potential vulnerabilities or performance issues. With a comprehensive report and, importantly, recommendations for each action required. Code Reviews Is your plugin or theme code secure and performing at its best? Tim provides a comprehensive code review, that combine the power of manual and automated testing, as well as a line-by-line analysis of your code base. With actionable insights, to help you optimise your code's security and performance. Or let's chat about your security? Book a **FREE 20 minute call** with me to see how you can improve your WordPress Security. (No Strings Attached, honest!), Advisory: Advanced Custom Fields Changes, Tim Nash, 01ja2smmpn94fs7830j5m2smcc.