An executive who saw the overseas news asks, "Our site was on WordPress, wasn't it. Is that safe?" and you have no ready answer. We received several messages like this in mid-September. As the person being asked you want to say "no problem" straight away, but an instant answer with no grounds stops working the next time something happens.
There is a part of this question where splitting the answer conveys it more accurately. What happened at a company and whether a site keeps running are not the same subject. Nor are they unrelated. Where you draw that line is the real substance of the question.
What was reported is one week in September
First, let us set out the facts, limited to what has been reported. Anything speculative is treated as speculation.
On September 9, 2026, the board of Automattic, which leads WordPress development, was reported to have passed a resolution placing CEO Matt Mullenweg on paid leave. Days later, on September 11, Mullenweg told employees on the company's Slack that he was back in charge, and on September 12 Automattic announced that he had returned as chairman and CEO with the board's support. On the 14th, further reports said executives and directors involved in the resolution had left the company.
The reason the board acted has not been made public so far. Automattic is in litigation with the hosting provider WP Engine, and some reports point to a connection, but no causal link has been confirmed. Stating this as fact in an internal explanation means having to correct it later.
For an internal audience, "there was a short burst of activity around the management structure, and the reason has not been made public" is explanation enough. Being able to say you do not know what you do not know earns more trust.
The company and the software are separate, but not entirely
This is the heart of how to answer.
WordPress is open-source software that anyone can use, modify and distribute under its license. The code is in your hands, and it runs on servers your company contracts for. If the executives of some company change, the files of the site you are running now do not disappear. In this sense, the two are separate.
On the other hand, at the center of WordPress development and distribution sit Automattic and organizations its founder is involved in. It is a fact that substantial influence over how the ecosystem is run is concentrated across plugin and theme distribution, core development direction, and relationships with commercial services. In this sense, they are not entirely separate.
For an explanation to executives, these two steps carry the message.
- Whether the site stops today or tomorrow — it will not. The site runs on your own server contract and your own files, and is not cut off by the developer's corporate situation
- How the multi-year outlook looks — parts of it depend on how the ecosystem is run, so it is something to keep watching
Combine these two and both "it is fine" and "it is risky" become untrue.
If you look at governance, fix the items you look at
A vague worry that "the organization behind it might be unstable" flares up every few years if you leave it alone. Fixing the items you look at saves you from rethinking it each time.
- Can you take it out? Can you export content and images together in a standard format? If you can, the question of who runs it becomes a question of migration cost. Only if you cannot does it become a real risk
- Are updates continuing? Are security fixes actually still being released? The release history reflects reality faster than any discussion of the organization
- Is it concentrated in one company? Are core development, hosting, plugins and themes concentrated in one particular company, or spread across several parties
- How deeply does your company use it? Are you within the range of standard features, or have you stacked up custom plugins and themes? The deeper you go, the more you feel changes at the organization behind it
The fourth is the one that matters most in practice, because with the same CMS, risk differs many times over depending on how you use it. For a corporate site with a standard configuration, switching stays a realistic option. A site built up with custom development can be in a state where changing CMS is effectively impossible to decide on. That state is the real reason for being sensitive to moves by the organization behind it.
Whether to switch is not decided by governance
It is natural to start wondering "should we move to another CMS" when news breaks, but the material for that decision sits on your side, not on the news side.
Whether to choose WordPress in the first place is decided by who updates the site, how often, and what they change. That analysis is covered in choosing a CMS before you place the order, at a stage before governance enters the picture. If you need a comparison with other options, whether to build on WordPress or Wix is the starting point.
If you do consider migrating, the real cost shows up not in "changing the CMS" but in "unpicking the custom implementation you have stacked up." Deciding on a rebuild for a site carrying old dependencies has the same structure as rebuilding a site that still depends on jQuery: the state of the internals, not the name of the CMS, determines the cost.
One more thing. Wherever you move because the organization behind your CMS changed, there is another organization behind that one. Move to a CMS or SaaS developed by a particular company, and the same kind of news arrives a few years later under a different name. What switching removes is only this particular worry; the structure remains. What you can reduce is the depth of the dependence. This thinking is shared with how to handle a change of supplier for a development library (a change of supplier, and reviewing dependencies).
What to do next
As material for answering your executives, check just one thing first. Can you export your site's content together in a standard format? Actually run the export function in the admin screen and confirm the contents open. If you can do that, you can state as fact that "even in the worst case, we can take it out."
Then ask your agency for a list of how many custom plugins and themes are installed. That number is how sensitive you are to moves by the organization behind the CMS. If the number is small, watching this news is all you need to do.
GleamHub handles reviews of site architecture and decisions on CMS selection and rebuilds through our website build and rebuild consultation. The options worth taking depend on your current configuration and how you update it, so please get in touch from our contact page.
Sources
- Automattic’s board forces CEO Matt Mullenweg into leave of absence — TechCrunch
- Matt Mullenweg tells Automattic staff in Slack he’s back in control after CEO ouster — TechCrunch
- Automattic confirms Mullenweg has returned as CEO after attempted ouster by board — TechCrunch
- Sources say Automattic’s board is out after failed attempt to oust CEO Matt Mullenweg — TechCrunch
