In one of the most controversial governance actions in web development history, WordPress.org invoked Point 18 of its repository guidelines to seize control of the advanced-custom-fields slug – a plugin active on over 5 million production websites – and unilaterally replace it with its own fork, rebranded as Secure Custom Fields (SCF).
The intervention directly bypassed the original plugin maintainers at WP Engine, altering the update stream for millions of deployments:
- Repository Takeover: WordPress.org used administrative authority to fork the free codebase, strip out commercial upsells and licensing hooks, and serve the fork directly to existing ACF installations.
- Forced Auto-Updates: Sites with automatic background updates enabled received code managed by an entirely different team without explicit consent from site administrators.
- Split Distribution Channels: In response, WP Engine established its own independent update server, requiring developers to manually reconfigure plugin sources or license keys to remain on the canonical ACF branch.
- Supply Chain Fallback: Community tools and deployment workflows immediately adapted, with widespread adoption of Composer-managed private packages and repository pinning to prevent accidental overrides.
The StackCompass Framing
For engineering teams and agencies building enterprise web solutions, this event fundamentally broke the trust model of the public WordPress repository. Treating the central plugin directory as an unvetted package repository is no longer a viable architectural posture.
When a repository owner can unilaterally alter the upstream codebase of a mission-critical dependency, automated production updates transform from a maintenance convenience into a severe supply-chain liability. Production WordPress installations must be treated with modern package hygiene: pin dependencies via Composer, route downloads through private mirrors (such as Satis or Private Packagist), and strictly disable runtime auto-updates in production environments.
Source: WordPress.org