Something truly unexpected happened in the WordPress community just before the weekend – a “product release,” sort of. You’ve probably already guessed what I’m talking about from the headline, so let’s skip the suspense.
So yeah, it looks like that on Nov 21, the “team” running the official profile of WordPress.org in the WordPress plugin directory released a plugin called exactly “Secure Custom Fields.”
“Wait, what?! Didn’t we already go through a controversy about this a few months ago?”
You’re not wrong – but that was a completely different controversy.
I know this whole thing sounds confusing and messy, so let me break it down for you. Here’s the situation as of today, Nov 25:
- There’s a plugin called Secure Custom Fields available at https://wordpress.org/plugins/advanced-custom-fields/. This is the “controversial fork” of the original Advanced Custom Fields (ACF) plugin, which is owned by WP Engine.
- But now, there’s another plugin also called Secure Custom Fields, available at https://wordpress.org/plugins/secure-custom-fields/. And this one? It’s reportedly a copy of the Pro version of the original Advanced Custom Fields plugin – being offered for free.
From what I can tell, WordPress.org essentially decided to “fork” or recreate the Pro version of ACF and make it freely available in the plugin directory.
David McCan on YouTube makes a good summary of what exactly was replicated in the new SCF:
How’s the community reacting?
Well, let’s just say most people are not happy about it. On Reddit, the response has been overwhelmingly critical – some might even say livid.
I won’t repeat the spiciest comments here, but trust me, it’s worth checking out for yourself.
The reviews on the new plugin have also not been great:
There’s also a different kind of reviews that state that the new SCF is allegedly creating some serious problems for sites previously using the original ACF:
For full transparency, though, there is a couple of positive reviews too:
Is this fair? Ethical? Legal?
Technically – and allegedly – WordPress’ actions are permitted under the GPL license. According to the armchair legal experts on Reddit (:wink-wink:), the GPL allows anyone to fork and redistribute open-source code.
But legality doesn’t always equal morality. Many in the WordPress community are asking if it’s ethical to take a commercial plugin, repackage it under a different name, and release it without giving proper credit to the original developers.
This controversy has sparked broader questions about how intellectual property is valued and protected in the open-source ecosystem of WordPress. Some commenters are even comparing this to “nulling,” a term typically used to describe the unauthorized distribution of premium plugins.
What’s adding fuel to the fire is the history here. Automattic has taken a strong stance against similar practices in the past. They’ve sued other platforms for distributing nulled versions of commercial plugins. Now, the WordPress profile itself is being accused of essentially doing the same thing: taking paid features from a plugin and making them available for free.
This double standard isn’t sitting well with the community. People are calling out the hypocrisy and questioning whether WordPress leadership is holding itself to the same standards it expects from others.
And the ripple effects? They could be significant.
All this will make developers think twice about contributing to the platform.
If premium plugins can be forked, stripped of their value, and redistributed under the WordPress banner, why would anyone take the risk of creating premium tools for WordPress? This could lead to an exodus of talent.
This situation also shines a spotlight on deeper governance issues within WordPress. The lines between the official WordPress project and Matt Mullenweg’s personal or corporate interests have often been blurry, and decisions like these only amplify that concern.
The lack of transparency is frustrating for many of us. Open-source projects are supposed to prioritize community input and shared decision-making, but moments like this make it feel like WordPress is moving in the opposite direction.
A call for reflection
This isn’t just another plugin controversy. It’s a moment for the WordPress community to pause and reflect on where we’re headed. What do you think of this whole situation?
…
Don’t forget to join our crash course on speeding up your WordPress site. Learn more below:
Matt obviously doesn’t get it, but he’s burning down the whole WordPress tent — just to punish WPEngine.
I have a _lot_ of opinions on this, but I think there’s an important technicality that most reporting of this has glossed over, and it’s how WP.org is getting away with distributing a copy of ACF Pro for free: it’s because ACF Pro is GPL. It didn’t need to be, since it’s not distributed in the repository, but it is. There’s no other copyright in the code. (I checked yesterday.)
I absolutely think this action was wrong from an ethical standpoint, but legally, it looks like they can do it. Premium plugin devs need to check the code of their paid versions and make sure they haven’t made the oversight ACF/WP Engine did in leaving the GPL terms in the Pro version.