Secure Custom Fields  ## Metadata - Author: [[Matt Mullenweg]] - Full Title: Secure Custom Fields - Category: #articles - Document Note: --- tags: - #wordpress - #securecustomfields - #opensource Author: WordPress.org Source: WordPress News Reference: [Secure Custom Fields Announcement](https://wordpress.org/news/2024/10/secure-custom-fields/) date created: 2024-10-12 22:15 --- # Title: WordPress Forks ACF: Introducing Secure Custom Fields ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: The WordPress security team announced the creation of a new plugin, Secure Custom Fields (SCF), by forking the widely used Advanced Custom Fields (ACF). This decision arose from a security vulnerability found in ACF, with SCF positioned as a safer, non-commercial alternative to ensure secure handling of custom fields. ## 📖 Main Content: Secure Custom Fields aims to address vulnerabilities in ACF by applying stricter security practices, such as escaping outputs to prevent malicious HTML injection. This move is part of WordPress’s broader security strategy, which emphasizes minimal commercial influence on core plugins. While the ACF team expressed discontent with the forced fork, Automattic cited security concerns and the removal of commercial upsells as critical drivers of the decision. ### 🗒️ Notes: - **Fork Details**: - SCF is a non-commercial fork of ACF. - Vulnerabilities allowed non-admin users to bypass protections in ACF. - **Impact**: - SCF replaces ACF on WordPress.org, automatically migrating users to the new plugin. - ACF updates can still be managed independently via WP Engine for those who opt out of the switch. ## 📖 References: - [WordPress.org Announcement](https://wordpress.org/news/2024/10/secure-custom-fields/) - [The WP Minute](https://thewpminute.com) - [TechCrunch Overview](https://www.techmeme.com) ## 🗣️ Paraphrase: 1. **Original Insight**: ACF relied on sanitization at save, leaving vulnerabilities. **Paraphrased**: ACF’s approach of sanitizing inputs during saving left some loopholes, leading to potential risks in post meta handling. 2. **Original Insight**: Automattic removed commercial features in SCF. **Paraphrased**: In the new Secure Custom Fields plugin, Automattic stripped commercial elements to align with WordPress’s non-commercial principles. ## 📰 Newsletter: **Title**: Introducing Secure Custom Fields: A Safer Way to Manage WordPress Custom Data 🔐 In a bold move, WordPress has forked the popular ACF plugin, creating Secure Custom Fields to address security vulnerabilities and remove commercial upsells. This transition, while controversial, underscores WordPress’s commitment to user safety and open-source values. Read more about the change and what it means for developers at [WordPress News](https://wordpress.org/news/2024/10/secure-custom-fields/). ## ✅ Action Items: This article exemplifies the intersection of open-source values, community governance, and software security, aligning well with your advocacy for sustainable development. As you work toward an OSPO role, studying this transition offers valuable lessons in handling conflicts and ensuring that security policies maintain transparency and trust across stakeholders. ## 🧪 Hypotheses: - Hypothesis 1: Forking critical plugins will encourage improved security practices across WordPress. - Hypothesis 2: Removing commercial elements from plugins may reduce adoption rates but increase trust within the community. ### 📊 Methodology: - **Data Collection**: Compare adoption rates before and after the introduction of SCF. - **Research Design**: Interviews with plugin developers and community surveys. - **Analysis**: Measure security incidents related to SCF versus ACF. ### ❓ Questions: - Will this forking process become a trend for other plugins in WordPress? - How will WP Engine’s response impact the trust dynamics within the WordPress community? ### 🔮 Future Research: - Explore community reactions to the SCF transition over time. - Assess the long-term viability of non-commercial plugin forks within open-source ecosystems. ### 💡 Implications: The SCF fork highlights the balance between community-driven development and commercial interests. Its success could set a precedent for future governance in the WordPress ecosystem. ### 🧠 Learning Styles Assessment: 1. **Visual Learners**: Add diagrams comparing SCF and ACF structures. 2. **Aural Learners**: Provide podcast discussions covering the controversy. 3. **Logical Learners**: Include detailed breakdowns of the vulnerability fix. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: Ensure all SCF documentation meets accessibility standards. - **Keyboard Navigation**: Improve plugin UI for seamless keyboard navigation. ### 🌍 DEIB Assessment: - **Inclusive Language**: Use clear and respectful communication in plugin documentation. - **Neurodiversity Support**: Break down technical details into concise, manageable sections. ### ✅ Logical Validity: - **Sound Reasoning**: Forking ACF to fix vulnerabilities is a logical solution. - **Potential Fallacy**: Criticisms risk framing the fork as purely competitive rather than security-driven. ### 🔍 SEO Evaluation: 1. **Keywords**: Secure Custom Fields, ACF, WordPress security. 2. **Title Optimization**: Use concise, keyword-rich titles. ## 🎯 Conclusion: The introduction of Secure Custom Fields marks a pivotal moment in WordPress’s governance, emphasizing security over commercial interests. As WordPress evolves, this transition reflects the community’s ongoing efforts to maintain trust and transparency while safeguarding user data. - Document Tags: [[Matt Mullenweg]] [[wordpress]] [[wpdrama]] - Summary: On behalf of the WordPress security team, I am announcing that we are invoking point 18 of the plugin directory guidelines and are forking Advanced Custom Fields (ACF) into a new plugin, Secure Cus… - URL: https://wordpress.org/news/2024/10/secure-custom-fields/ On behalf of the [WordPress security team](https://wordpress.org/about/security/), I am announcing that we are invoking [point 18 of the plugin directory guidelines](https://github.com/wordpress/wporg-plugin-guidelines/blob/trunk/guideline-18.md) and are forking Advanced Custom Fields (ACF) into a new plugin, Secure Custom Fields. SCF has been updated to remove commercial upsells and fix a security problem. On October 3rd, the ACF team announced ACF plugin updates will come directly from their website. This was also communicated via a [support notice](https://wordpress.org/support/topic/future-updates-for-acf-are-available-through-their-website/) in the [WordPress.org](https://wordpress.org/) [support](https://wordpress.org/support/plugin/advanced-custom-fields/) forum on Oct 5th. Sites that followed the ACF team’s instructions on “How to update ACF” will continue to get updates directly from WP Engine. On October 1st, 2024, WP Engine also deployed its own solution for updates and installations for plugins and themes across their customers’ sites in place of [WordPress.org](https://wordpress.org/)’s update service. Sites that continue to use [WordPress.org](https://wordpress.org/)’s update service and have not chosen to switch to ACF updates from WP Engine can click to update to switch to Secure Custom Fields. Where sites have chosen to have plugin auto-updates from [WordPress.org](https://wordpress.org/) enabled, this update process will auto-switch them from Advanced Custom Fields to Secure Custom Fields. This update is as minimal as possible to fix the security issue. Going forward, Secure Custom Fields is now a non-commercial plugin, and if any developers want to get involved in maintaining and improving it, please get in touch. Similar situations have happened before, but not at this scale. This is a rare and unusual situation brought on by WP Engine’s legal attacks, we do not anticipate this happening for other plugins. WP Engine has [posted instructions for how to use their version of Advanced Custom Fields that uses their own update server](https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/), so you have that option, though the WordPress Security Team does not recommend it until they fix the security issues. You can uninstall Advanced Custom Fields and [activate Secure Custom Fields from the plugin directory](https://wordpress.org/plugins/advanced-custom-fields/) and be just fine. There is separate, but not directly related news that [Jason Bahl has left WP Engine to work for Automattic and will be making WPGraphQL a canonical community plugin](https://www.wpgraphql.com/2024/10/07/wpgraphql-becomes-a-canonical-plugin-my-move-to-automattic). We expect others will follow as well., Secure Custom Fields, Matt Mullenweg, 01ja19wnkzfd9xvj3q5bpx8ny8.