Impact of WPEngine’s Ban on ACF Plugin ![rw-book-cover]() 🔗 **Source:** [Impact of WPEngine’s Ban on ACF Plugin](https://wptavern.com/impact-of-wpengines-ban-on-acf-plugin) > [!note]+ Document Notes > --- > tags: [acf, wp-engine, wordpress-org, plugins, security, wp-tavern-archive, wp-tavern-2024] > author: Jyolsna > source: WP Tavern > reference: https://wptavern.com/impact-of-wpengines-ban-on-acf-plugin > date created: 2026-04-17 10:22 > --- > # Impact of WPEngine's Ban on ACF Plugin > ## 📝 Summary > - WP Engine's ban from WordPress.org prevented the ACF team from releasing updates to the free version of the plugin on October 3, 2024. > - Users were unable to automatically update ACF, though WP Engine and Flywheel customers could still receive automatic updates; the ACF team provided manual update guidance. > - ACF PRO customers were unaffected as updates continue to be served from advancedcustomfields.com. > - Automattic disclosed a vulnerability in ACF but was criticized by the WordPress Core Security Team Lead for breaching responsible disclosure protocols by announcing it publicly. > - The incident highlights tensions between Automattic and WP Engine amid broader WordPress ecosystem conflicts. > ## 💬 Comments (10) > The comment thread shows mixed perspectives, with some defending Matt Mullenweg's leadership of WordPress while others suggest alternative plugins like Pods as solutions to the ACF situation. > --- > --- > ## 💬 Comment Thread > ### jeswin — 2024-10-09T10:49 > WordPress is his life’s work and his legacy. No design-by-committee model is going to give you the same consistent, decisive, nonstop forward momentum that we have experienced with WordPress thus far. After 21 years of delivering on this, I believe Matt is uniquely qualified to steer the project forward. > ### Rebekah — 2024-10-09T10:49 > The alternative is called Pods > https://pods.io/ > . Which was sponsored by Automattic for almost 10 years. You think they would remember it. A great FREE and powerful alternative to ACF. > ### Will — 2024-10-09T10:49 > Matt is becoming a sort of off-brand Elon Musk. I do agree that WP Engine should contribute more to WP, but these sorts of childish antics are harmful to the community and it clearly impacts more than just those hosted with WPE. > ### Steven Gliebe — 2024-10-09T10:49 > This blog should disclose ownership in articles reporting on Audrey Capital and Automattic entities and their leadership, or their competitors. WP Engine is a competitor of WordPress.com for example. Transparency is important. > ### Drew — 2024-10-09T10:49 > “we could auto-migrate all current users of the plugin into our core functionality” > It was only a matter of time before King Matt decided to embrace, extend and extinguish. > If he interferes with ACF Pro then WordPress and I are done. I have 40+ sites running ACF Pro but am already doing all new development in ProcessWire and am starting to migrate some existing sites from WP to PW. The primary reason? Matt. > ### Matthew — 2024-10-13T07:55 > Wow. Seeing that idea of just taking people of products and merging them into core is an absolutely horrible thing to be contemplating. > Basically just stealing their work because its legal, doesn’t make it ethical. > It could absolutely destroy small businesses, and it’s a real threat as they have the developer resources to thrown at it merging. Why would anyone bother to put their time in if this is how he sees community code? It sounds like he wouldn’t have a problem to start up an official nulled plugin repository then, with that attitude. > Not only is that a terrible thing to read, it’s also a terrible idea on the whole. There are tons of paid plugins that Woo and WP have absorbed over the years, and they are absolutely languishing with prices being increased and no features being added, no bugs fixed, no acknowledgement of the piles of feature requests. > That is actually really really bad behaviour to be talking like that. I’ve been trying to wait and see what this is actually all about at a legal level and give him the benefit of the doubt, but bringing all the eyes of the internet onto him is not a smart move if he has been going around saying abhorrent things like this. > ### ibhuiyan — 2024-10-14T13:38 > On a personal level, I stopped using WP for my personal blog site ever since Block editor was introduced but I don’t mind using WP for my clients sites. > ### Matthew — 2025-01-02T22:33 > Yeah I did not take a liking to the block editor when it was first released. > I have slowly got some use out of it by letting it be the default editor for the blog posts, and still sticking with page builders for the actual site layout. > If you haven’t done it recently, spin up a new wp install and go through the set up steps. It has totally changed now, with a really slick onboarding experience. You wouldn’t even recognise it as WordPress. > Plus the block editor isn’t that bad for basic editing and actually can even manage some advanced scenarios now. > I think this is difficult for existing users to adjust to as its a “who moved my cheese” type situation, but from a clients point of view where they might already have tried out Wix or Squarespace, this kind of slick interface is what they are looking for. > ### Mark Quigg — 2024-11-26T12:19 > I sincerely hope Matt and the leadership at WordPress are taking careful note of responses like these. He is on a mission to destroy or seriously punish WPEngine, at all costs evidently. Why? Because he doesn’t believe they contribute enough to WordPress as an open source project. Maybe they don’t, I don’t know, but I do know that he is putting the entire project at risk — and probably billions of dollars worth of human investment in time and money into WordPress websites — all to punish WPEngine. There ARE other open source platforms out there, and people will get fed up with this drama, and the potential risk of their own investments into the WordPress ecosystem, and just move on. Maybe he’ll succeed at punishing or destroying WPEngine, but it will just be a massive pyrrhic victory with everybody being the losers. > ### Bruce — 2025-01-02T22:32 > Just logged into wordpress.org to log a plugin bug report. The login form now includes a checkbox which says ‘I am not affiliated with WP Engine in any way, financially or otherwise.’ > Does this mean WPE customers are no longer welcome at wordpress.org ??? When WP Engine was blocked from accessing WordPress.org, users were left wondering what the future holds for ACF (Advanced Custom Fields) and how this ban will impact their sites moving forward. ##### ACF Blocked from WordPress.org On October 03, 2024, ACF (Advanced Custom Fields) [announced](https://x.com/wp_acf/status/1841843084700598355) via X that “The ACF team has been blocked from accessing WordPress dot org and are unable to release updates for the free version of ACF.”  WP Engine, the owners of the ACF plugin, were earlier [banned from accessing WordPress.org](https://wptavern.com/wp-engine-banned-again-reports-deploying-a-solution) , which prevented the ACF team from deploying updates to the free version hosted on the platform. So the users were unable to automatically update ACF to newer versions. To help users, the ACF team  shared a [guide to manually update](https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/) to the latest version of the plugin. Customers of WP Engine or Flywheel, however, could still receive automatic updates for the free version. The ACF team assured users that “Recent events do not impact customers of ACF PRO. All updates of ACF PRO will continue to be served from advancedcustomfields.com and no action is required.” They also noted, “While there are no pending security updates for ACF, this alternative update mechanism ensures your sites are ready to receive new features, bug fixes, and security updates going forward.” ##### Automattic’s Vulnerability Announcement However, Automattic soon tweeted about a vulnerability in the plugin. The tweet was later deleted.   In response, John Blackbourn, WordPress Core Security Team Lead, [tweeted](https://x.com/johnbillion/status/1842627564453454049), “Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF.”  > Automattic has responsibly disclosed a vulnerability in ACF but breached the [@Intigriti](https://twitter.com/intigriti?ref_src=twsrc%5Etfw) Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF. <https://t.co/LpMhvAIQou> > > — John Blackbourn (@johnbillion) [October 5, 2024](https://twitter.com/johnbillion/status/1842627564453454049?ref_src=twsrc%5Etfw) ##### Matt Mullenweg’s Comments on ACF Previously, Matt Mullenweg had raised the idea of integrating ACF Pro into WordPress core in WordPress [Slack](https://wordpress.slack.com/archives/C02RQBWTW/p1727501240087269) channel .   On October 05, Matt Mullenweg [tweeted](https://x.com/photomatt/status/1842500184825090060): “What are the best alternatives to Advanced Custom Fields @wp\_acf for people who want to switch away? Is there an easy way to migrate? I suspect there are going to be millions of sites moving away from it in the coming weeks.” However, most of the replies he received were favouring the plugin. > ACF is literally the reason why so many people choose to build with WordPress. > > Does he really think people will want to switch away and spend tons of hours rebuilding everything? > > Doesn’t make sense, and that’s likely never going to happen. > > We use ACF on almost every website we… <https://t.co/KNUlbUHAse> > > — Corentin (@corxntyn) [October 5, 2024](https://twitter.com/corxntyn/status/1842596017725673677?ref_src=twsrc%5Etfw) > ACF is what made WordPress actually useful as a CMS well over a decade ago, and it's block features are what continue to make it useful in a Block Editor world that is impractical to approach natively. There is nothing comparable. <https://t.co/1rEHtEEOcn> > > — Galen Gidman (@galengidman) [October 5, 2024](https://twitter.com/galengidman/status/1842580286200283418?ref_src=twsrc%5Etfw) > Dear Matt, > I tell you in roman slang: > "Non famo cazzate, su!" > > There's NO ALTERNATIVE! > > Keep on fighting against WPEngine. Destroy it if you want/can. > Many don't give a fuck about it. > > But ACF is something any WP dev out there has been using for years. We love it. Wee need it. <https://t.co/GlU5gcWUIV> > > — Mauro Bono (@UpTheIrons1978) [October 6, 2024](https://twitter.com/UpTheIrons1978/status/1842907760431669666?ref_src=twsrc%5Etfw) > Core ignores agency features for the last 5 years of block development. Asks for alternatives to ACF. Delusional. > > — philhoyt (@philhoyt) [October 6, 2024](https://twitter.com/philhoyt/status/1842729361079722076?ref_src=twsrc%5Etfw) Meanwhile, Ghost, another open-source CMS jumped into the fray [asking](https://x.com/Ghost/status/1843065099969536409) “so should we add custom fields?”  ##### ACF 6.3.8 released The ACF team [shared](https://x.com/wp_acf/status/1843329216009400818) that they have released [ACF 6.3.8](https://www.advancedcustomfields.com/blog/acf-6-3-8-security-release/), a routine security release. “WP Engine remains blocked from accessing our plugins on the .org plugin repository and therefore this update has been shipped to WP Engine’s repository and to the ACF website.”, they said. > > This latest release contains a security fix for Post Type and Taxonomy metabox callbacks. The vulnerability addresses the unlikely scenario where one user with ACF admin permissions attacks a different admin user with permissions to create or modify posts, or in a Multisite configuration where a single site admin attempts to exploit a super admin to modify or add a new post. > > > Iain Poulson, the Product Manager for Advanced Custom Fields > > > They also shared that: “Once manually updated to 6.3.8, updates will appear in the admin dashboard as normal going forward. No more manual zip updates will be required.”  The team also shared that “We made a copy of the update available to the WordPress.org Security team, who have posted it to the plugin repository.”  ##### Other Updates In related news, WP Tavern’s ex-author Sarah Gooding published [21 Years of WordPress](https://sarahgooding.dev/2024/10/06/21-years-of-wordpress/). “I don’t fully agree with how Matt has handled this matter, but I will not support any governance model that doesn’t have his leadership at the forefront. WordPress is his life’s work and his legacy. No design-by-committee model is going to give you the same consistent, decisive, nonstop forward momentum that we have experienced with WordPress thus far. After 21 years of delivering on this, I believe Matt is uniquely qualified to steer the project forward. His leadership has built something truly extraordinary.” Kaelon [tweeted](https://x.com/Kaelon/status/1843013559980003682) about how “WordPress is entering its “end-stage founder” period.” His advice for WP and Matt includes, “Do not turn on your people.”, “Step the Founder back.” and “Reinvent.” The WP Minute’s Eric Karkovack published [Private Equity and the Soul of WordPress](https://thewpminute.com/private-equity-and-the-soul-of-wordpress/). He says “Perhaps having a few private equity-owned WordPress products isn’t a big deal…The real threat is an ecosystem controlled by a few big firms…That’s only half the potential catastrophe, though. Companies that are in it for the short-term may not be compelled to give back to WordPress core.” Category: [News](https://wptavern.com/category/news), [Plugins](https://wptavern.com/category/plugins)Tags: [acf](https://wptavern.com/tag/acf), Impact of WPEngine’s Ban on ACF Plugin, Jyolsna, 01kpdx5pgn2exaarqkgs58area.