Automattic's 48-hour CEO reversal: your CMS has key-man risk

On Wednesday, Automattic's board removed Matt Mullenweg as CEO and installed CFO Mark Davies as interim. On Friday morning, Mullenweg posted in the company Slack that he was back in charge, deactivated the interim CEO's account, and stripped every other Slack admin. Automattic has not confirmed the reversal. If your storefront runs on WordPress or WooCommerce, this is not gossip — it is a governance stress test on a dependency you probably have not audited.

What actually happened

The timeline, per TechCrunch:

Wednesday, September 9. Automattic's board voted to put Mullenweg on paid leave. The company confirmed the leave and named CFO Mark Davies interim CEO. Mullenweg told staff in Slack the board had "conspired" against him.

Friday, September 11, early morning. Mullenweg posted that "the board is back in agreement, and I'm in control of Automattic." He removed all Slack admins. Davies' Slack account was deactivated. Asked whether he was trolling, he answered: "I'm not a troll I'm a pirate, obviously."

Friday afternoon. Mary Hubbard, Executive Director of WordPress.org, posted that she was "relieved and pleased" to see Mullenweg return as CEO.

Here is the part to hold onto: Automattic itself has not issued a statement confirming the reversal. What is confirmed is the September 9 board action and the interim appointment. Everything after that is one executive's claim in a private Slack, plus a supportive post from an adjacent org. Do not treat the resolution as settled.

Why CMS governance matters for your business

Automattic is not a single product. It is WordPress.com hosting, WooCommerce, Jetpack, and Akismet — and Mullenweg's personal control of WordPress.org has been the flashpoint in prior disputes. For a small operator, that is four load-bearing dependencies whose direction can be set by the outcome of a boardroom fight you are not in.

Three things worth doing this week, none of which require you to predict the ending:

Separate what you host from what you rent. A self-hosted WordPress install with WooCommerce keeps your orders, customers, and products in a MySQL database you can dump tonight. A WordPress.com-hosted site with Jetpack handling backups, search, and CDN keeps far more of that in someone else's account. Write down which side of that line each piece of your stack sits on.

Pull a real export, not a backup you have never restored. Orders, customers, products, and media, out of the database and onto storage you control. Then restore it somewhere and confirm it boots. An untested backup is a belief, not a plan. The same discipline applies to plugin dependencies — we made this point when WordPress 7.1 opened the Abilities API to agents, and it holds here.

Know your plugin blast radius. Count how many of your active plugins are maintained by Automattic or depend on a WordPress.com account to function. That number is your exposure to this specific company's stability. If it is high, that is not an emergency — it is a roadmap item.

We are not predicting an Automattic collapse. WordPress runs a large share of the web and WooCommerce is a genuinely good commerce stack. The point is narrower: a project that critical having its control concentrated in one person is a structural fact, and structural facts are what you plan around. The correct reaction to a 48-hour CEO reversal is not to migrate in a panic. It is to be able to.

Sources: TechCrunch: Matt Mullenweg tells Automattic staff in Slack he's back in control after CEO ouster, TechCrunch: Automattic's board forces CEO Matt Mullenweg into leave of absence.