WordPress News Roundup September 2026: WordPress 7.1.2 Release, Automattic’s Board Puts Matt Mullenweg on Leave for 33 Hours

September 2026 delivered one of the most dramatic corporate stories in WordPress history. On September 9, Automattic’s board placed founder and CEO Matt Mullenweg on paid leave and named the company’s CFO interim CEO. Roughly 33 hours later Mullenweg was back in control, the directors behind the vote were gone, and by the end of the month he had installed an entirely new board.

The WordPress project itself kept moving. The 7.2 release squad was named with Mullenweg as release lead, plugin releases began passing through automated AI-assisted security review, a court revived WP Engine’s antitrust claims, and WordPress 7.1.2 fixed a critical core flaw that attackers began probing within hours.

Mergers, Acquisitions, and Investments

No major WordPress acquisitions were announced in September. The month’s biggest business news was about control of Automattic itself.

• The board vote: TechCrunch reported on September 9 that directors Toni Schneider, Sue Decker and Ann Dunwoody had voted to place Mullenweg on paid leave and named CFO Mark Davies interim CEO. Mullenweg said he voted against the resolution, received it 50 minutes before the meeting and was not given time for independent legal review. No reason was given publicly.
• The reversal: Mullenweg, who has said he controls about 84% of Automattic’s voting power, regained control within days. Automattic later said he had been away for 33 hours and 20 minutes. Schneider and Decker resigned, Dunwoody was removed, and Davies and the company’s chief legal officer left the company.
• A new board: On September 25, TechCrunch reported that Mullenweg had appointed new directors, including author Hugh Howey, author Amy Chan, and IRL co-founders Henry Khachatryan and Krutal Desai.
• The project carried on: WordPress Executive Director Mary Hubbard said during the leave that Mullenweg remained the leader of the WordPress open source project and that its work would continue as planned.

WordPress Core Updates

• WordPress 7.1.1 (September 17): A maintenance and security release with 17 core fixes, 19 block editor fixes and 11 security fixes, including stored XSS in wpautop(), authenticated path traversal in the REST templates controller and a flaw that let Contributor+ users overwrite posts. Adam Silverstein, Adrian Duffell, Andrei Draganescu and Aaron Jorbin led it.
• WordPress 7.1.2 (September 22): A security release fixing CVE-2026-87902, a critical flaw that let unauthenticated attackers make page template resolution include a local PHP file outside the theme directories, which can lead to remote code execution under certain server and theme conditions. Robert Ressl reported it, John Blackbourn led the release, and fixes were backported to every branch back to 4.7.
• WordPress 7.2 squad: The 7.2 squad, announced September 9, is led by Matt Mullenweg, with David Baumwald on coordination, George Mamadashvili and Peter Wilson as tech leads and Henrique Iamarino leading design for the new default theme. Final release is planned for early December.
• Roadmap to 7.2: Anne McCarthy’s roadmap, published September 18, introduced the default theme as Ipsum, a break from year-based theme names. Planned work includes a suggestion mode for Notes, a Secrets API for storing credentials, sudo-style re-authentication for sensitive actions, Application Password hardening and Table of Contents and Description List blocks. Real-time collaboration is deliberately left out, and AI work continues in the AI plugin.

Other WordPress News

• Automated plugin review: On September 9, the Plugins Team announced that every plugin release is now analysed during the update cooldown by several AI models and Jetpack Scan. Their findings are combined into a risk score, and high-risk releases are blocked automatically, without waiting for a human reviewer, until the author fixes the issues.
• WP Engine’s antitrust claims revived: On September 24, Judge Araceli Martínez-Olguín allowed WP Engine’s four amended antitrust claims (monopolization, attempted monopolization and two tying claims) to proceed, while its computer extortion claim stayed dismissed. Most of the seven counterclaims from Automattic, Mullenweg, WooCommerce and the WordPress Foundation also survived, some only in part, though the judge found Automattic and Mullenweg were not owners of the marks they asserted.
• Open Website Alliance: Mary Hubbard became president of the Open Website Alliance, the group of organisations behind Drupal, Joomla!, TYPO3 and WordPress, representing the WordPress Foundation in its rotating presidency.
• Education programs: WordPress.org reported that students at two campuses in Kishoreganj, Bangladesh built 108 websites in two weeks, alongside a workshop in eastern Uganda held without electricity for more than 100 learners.

Security Alerts and Plugin Vulnerabilities

• CVE-2026-87902 exploited quickly: Patchstack saw attackers probing for the 7.1.2 flaw within hours of the release, and CISA added it to its Known Exploited Vulnerabilities catalogue within days. Sites without automatic background updates should confirm they are on 7.1.2 or a patched branch release.
• The Events Calendar: Two critical unauthenticated remote code execution flaws (CVE-2026-78159 and CVE-2026-78006) were fixed in versions 6.17.3.1 and 6.17.4.1.
• Unlimited Elements for Elementor: A high-severity unauthenticated SQL injection (CVE-2026-18561), fixed in 2.0.17, was disclosed on September 10.
• WPForms and Really Simple Security: WPForms 2.0.2.1 fixed an unauthenticated arbitrary shortcode execution issue (CVE-2026-84744), and Really Simple Security 9.8.1 fixed an unauthenticated two-factor authentication bypass.

Industry Trends and Insights

• Governance questions resurface: The failed board action showed how much of WordPress’s commercial ecosystem depends on one person who leads both Automattic and, as 7.2 release lead, the next core release. It will fuel renewed debate about the separation between the company and the open source project.
• The legal fight gets longer: With both WP Engine’s antitrust claims and Automattic’s trademark counterclaims surviving, neither side has a quick exit, and a jury trial is not expected before 2027.
• AI becomes a gatekeeper: Automated blocking of risky plugin releases is the first time WordPress.org has let machine analysis stop a release on its own. It answers the supply chain worries raised since April, at the cost of occasional false positives.
• Market share pressure: W3Techs figures continued to slide toward 40% of all websites, keeping the conversation about WordPress’s competitiveness alive.

Theme of the Month: Ipsum

Ipsum, revealed in the 7.2 roadmap as the next default theme, breaks with more than a decade of year-based names. It is a deliberately minimal blogging theme meant to be a blank canvas for users to build their own design, signalling a simpler starting point for every new WordPress site.

Plugin of the Month: Jetpack

Jetpack Scan became part of WordPress.org’s own plugin review pipeline in September, one of the tools that scores every release during the update cooldown. Jetpack has also added podcasting tools for publishing, distributing and measuring shows directly from WordPress.

Host of the Month: WP Engine

WP Engine was back in the spotlight after the court allowed its antitrust claims against Automattic and Mullenweg to proceed. The ruling keeps alive the central question of the dispute, whether hosts building commercial services on WordPress can be required to pay for use of the name, which matters to every managed WordPress provider.

Founder of the Month: Matt Mullenweg

No one else could be founder of the month. Matt Mullenweg was placed on leave as Automattic’s CEO by his own board, regained control in about a day and a half, replaced the board, and in the same month took on the release lead role for WordPress 7.2. Whatever one thinks of the episode, it confirmed that control of Automattic rests firmly with its founder.

Looking Ahead to October 2026

WordPress 7.2 Beta 1 is scheduled for October 20, which also marks feature freeze, followed by weekly betas into November. A magistrate judge is due to hear WP Engine’s request for sanctions over the preservation of Mullenweg’s messages in early October. Kraków University of Technology’s new WordPress course, announced at WordCamp Europe, also begins in October.