In October 2024, WordPress.org unilaterally took over Advanced Custom Fields - a paid plugin owned by WP Engine - and republished it under a new name in the middle of a legal feud between Automattic and WP Engine. The 'fork' was the platform itself, using its control of the directory to seize a competitor's product.
SCF is byte-for-byte ACF with the branding changed: the same codebase, same plugin slug in the WordPress directory, same update channel. The technical 'fork' was trivial; the infrastructure was the weapon. The takedown was possible only because ACF's users had delegated their own update decisions to WordPress.org's auto-update system.
Advanced Custom Fields, created by Elliot Condon in 2011, is one of the most widely used WordPress plugins of all time, installed on more than two million sites. In June 2022 it was acquired by WP Engine as part of the Delicious Brains deal. By late 2024, WP Engine was locked in a trademark and hosting dispute with Automattic and its CEO Matt Mullenweg, who publicly attacked the company as a 'cancer to WordPress'. On September 25, 2024, Automattic blocked WP Engine from accessing WordPress.org servers entirely.
The dispute escalated in October when WordPress.org announced that because WP Engine could no longer update its plugins, it would take over updates of ACF itself - renaming it 'Secure Custom Fields' and serving it to the two million sites that had the plugin installed. The original was replaced in the directory, its slug redirected, and sites with auto-updates enabled received the SCF package. WP Engine called it theft: 'A plugin under active development has never been unilaterally and forcibly taken away from its creator without consent in the 21 year history of WordPress'. A federal judge agreed in December 2024, ordering Automattic to restore ACF to the directory within 72 hours. The trademark and antitrust lawsuit continues, with a jury trial scheduled for October 2027, and in the meantime the WordPress.org SCF fork quietly remains online under its own listing.
Elliot Condon releases Advanced Custom Fields.
WP Engine acquires ACF as part of the Delicious Brains acquisition.
Automattic blocks WP Engine from WordPress.org servers.
WordPress.org replaces ACF with 'Secure Custom Fields', redirecting the plugin slug and force-updating sites.
SCF receives its own directory listing with more than 80,000 installs.
Judge Araceli Martínez-Olguín issues a preliminary injunction ordering ACF restored to the directory within 72 hours.
Jury trial in the Automattic v. WP Engine lawsuit is scheduled.
“This is a rare and unusual situation... The technical infrastructure of WordPress is being used by WP Engine to their commercial advantage.”
“We are working to restore the original plugin to its rightful place.”
“A plugin under active development has never been unilaterally and forcibly taken away from its creator without consent in the 21 year history of WordPress.”
The ACF takeover became the canonical example of platform risk in open-source adjacent software: the owners of the distribution channel weaponized it against a company they were suing. It drove a surge in private/paid plugin distribution, made every major plugin owner review their exposure, and is now part of a federal antitrust case that could reshape WordPress governance.