More context:

"Due to recent events in the WordPress ecosystem, WP Engine employees have been blocked from accessing WordPress.org. This means the ACF team is unable to deploy updates to the free version of ACF hosted on WordPress.org and users running this plugin on their sites were removed from the ability to automatically update to newer versions."[0]

Matt really meant it when he said he was going nuclear.

0. https://www.advancedcustomfields.com/blog/installing-and-upg...

Context if you already know Automattic's recent actions: ACF is the most popular WordPress plugin, created and maintained by WP Engine.

It was not created by WP Engine, they bought a mature product from the original developer Elliot Condon.

https://www.advancedcustomfields.com/blog/10-years-of-acf-a-...

WP Engine buy it from Condon, he had already sold it to another company. WP Engine purchased that company and their suite of plugins

Also not the most popular WP plugin — that’d be Yoast SEO.

That's [flagged]

For those who can’t see the tweet:

“Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF.”

The tweet author is @johnbillion who, among other things, is a member of the WordPress core team and lead of the WordPress core security team.

Context for the “I am going to work my damned hardest...”: WP Engine, who own ACF (Advanced Custom Fields) are currently blocked from the official plugin repo so, I would imagine, they would not be able to push the update on their own.

> The tweet author is @johnbillion who, among other things, is a member of the WordPress core team and lead of the WordPress core security team.

What's good about this scenario is that @johnbillion isn't employed by Automattic/Audrey, and wouldn't face financial consequences if he went against Matt's wishes.

Until Matt decides to block any IP addresses he's using to access WordPress.org...

John is one guy. A vpn will get around any blocks unless Matt nukes his WP.org account (extremely unlikely). The only reason WP Engine is blocked is due to corporate security rules and accounts all using a @wpengine email address

Update: The Automattic tweet (the one announcing that Automattic “responsibly disclosed” a vulnerability to WP Engine) has now disappeared.

This feels like further beef in the whole Automattic vs WPEngine drama.

Except this incident potentially puts people's data at risk, I hope WPEngine forks Wordpress and people swap to the fork, Automattic no longer can be trusted.

Original tweet (since deleted): https://imgur.com/a/OIB65Ro

I've always been of the understanding that "responsible" disclosure by definition means only disclosing to the vendor. Shouting on twitter that "plugin X has a security vulnerability!" before giving the vendor time to address it is hardly responsible.

Quite the opposite in fact.