By MC Franklin Jr., Editor-in-Chief · Published September 28, 2026
If your website, your store or your client work runs on WordPress, the past three weeks at Automattic were not celebrity gossip. They were a governance stress test on a platform a lot of small businesses quietly depend on. The board tried to remove the CEO, lost, and no longer exists.
Below is what actually happened, and the narrow part of it that should change what you do this quarter.
“We are living through times of unprecedented change, possibly a singularity. The next six months will determine the next 20 years of Automattic.”
Matt Mullenweg, quoted in TechCrunch — reporting by Sarah Perez
The short version, per that reporting: the board voted in early September to put Mullenweg on paid leave. He reversed it inside 33 hours using roughly 84% of the company’s voting control, then replaced the board outright. Toni Schneider, Gen. Ann Dunwoody and Sue Decker are out. Hugh Howey, Amy Chan, Henry Khachatryan and Krutal Desai are in. The CFO and the chief legal officer were terminated.
Our take
Governance is a vendor risk, and almost nobody prices it. Small businesses audit uptime, plugin compatibility and hosting cost. Very few ask who controls the company behind the platform, and what happens when that person is challenged. This month answered the question for WordPress.
The number that matters here is not 33 hours. It is 84%. TechCrunch reports Mullenweg used roughly that share of voting control to reverse the board’s decision and install a new one. That is a supervoting structure working exactly as designed. It is legal, it is common among founder-led companies, and it means the board is advisory in practice no matter what the org chart says. If you were counting on independent directors to catch a bad call at Automattic, that mechanism is gone.
Look at who replaced them. A science-fiction novelist, an author who writes about breakups, and two co-founders from the same startup. These are people the CEO chose. None of that makes them unqualified to advise a company. It does mean nobody at that table was picked for their willingness to say no.
The departures tell you more than the arrivals. Automattic terminated its CFO and its chief legal officer. Those are the two seats that touch every enterprise contract, every renewal and every piece of active litigation — and Automattic is still in a trademark fight with WP Engine. A legal chief leaving mid-dispute is not a sign the dispute is resolving. It is a sign the strategy behind it may change, in a direction nobody outside the company can predict yet.
Here is the part most coverage skips. Your exposure is not “WordPress.” Separate the two things that share that name.
The software is GPL-licensed. It runs on your own server, it can be forked, and no boardroom vote deletes the copy sitting in your hosting account. That risk is close to zero, and panic-migrating a working site is a self-inflicted wound.
The commercial layer is different. WooCommerce, Jetpack, WordPress.com hosting, Akismet, Tumblr — those are products of one company with one person in effectively unchecked control. Prices, roadmaps, support terms and acquisition decisions all sit downstream of that. If your store’s checkout, your backups or your spam filtering come from that stack, you have real concentration risk, and it just got harder to forecast.
That distinction should drive what you do next. The question is not “is WordPress safe.” It is “how fast could I move if one product in this stack doubled in price or shipped a change I hate?” If the answer is measured in months, you have a problem worth working on this quarter. If it is measured in days, you are fine and you can ignore the headlines.
There is a client-facing dimension too. Your clients read tech headlines with the word “coup” in them. An agency that already has a one-paragraph answer ready looks like the adult in the room. An agency that gets caught guessing on a Tuesday call does not. That gap costs retainers, and it costs nothing to close.
What this means for your business
- Write down every Automattic product in your stack this week. Check your plugin list for WooCommerce, Jetpack, Akismet, VaultPress and WordPress.com hosting. Most operators discover they are deeper in than they assumed, because Jetpack arrives bundled and nobody re-reads the bundle.
- Verify you hold your own backups somewhere Automattic does not control. If your only restore point lives inside a Jetpack or WordPress.com plan, that is a single point of failure for both technical and commercial reasons. Add an independent nightly export of database and uploads, and test a restore once.
- Price the exit on your highest-risk product before you need it. Pick the one that would hurt most — usually WooCommerce on a revenue-generating store — and get a real number for hours and dollars to move it. You are not migrating. You are replacing “we’d be in trouble” with a figure you can decide against.
- Draft the client paragraph now and send it proactively. Three sentences: the software your site runs on is unaffected, here is the commercial dependency we reviewed, here is what we changed. Sending it first turns a scary headline into evidence that you watch this stuff.
- Stop buying new dependencies from one vendor by default. When the next plugin decision comes up, treat vendor concentration as a line item alongside price and features. One company owning your checkout, your CDN, your spam filter and your backups is a risk you chose by accident.
Full reporting on the board change, including the complete list of incoming directors and advisers, is at TechCrunch: Automattic has a new board after failed attempt to put CEO on leave, by Sarah Perez.
Put AI to Work for Your Business
MCNM Marketing — the team behind this publication — helps businesses across Las Vegas, Southern California, and Northern Arizona turn stories like this into revenue with AI marketing solutions, SEO & digital strategy, and marketing automation. A+ BBB rated.
