HackerTrans
TopNewTrendsCommentsPastAskShowJobs

pluginvulns

no profile record

Submissions

[untitled]

1 points·by pluginvulns·2 years ago·0 comments

Attacker Adding Malicious Code to Legitimate WordPress Plugins Quickly Caught

pluginvulnerabilities.com
3 points·by pluginvulns·2 years ago·0 comments

Is_admin() Again Leads to WP Plugin Containing Vuln That Hackers Would Exploit

pluginvulnerabilities.com
1 points·by pluginvulns·4 years ago·0 comments

Hacker Probably Targeting Auth Option Update Vulnerability in Make's WP Plugin

pluginvulnerabilities.com
1 points·by pluginvulns·4 years ago·0 comments

Only Two WordPress Security Plugins Prevented Exploitation of Serious Vuln

pluginvulnerabilities.com
2 points·by pluginvulns·4 years ago·0 comments

[untitled]

1 points·by pluginvulns·4 years ago·0 comments

comments

pluginvulns
·2 years ago·discuss
Top lawyers at his company, Automattic, have been leaving: https://www.pluginvulnerabilities.com/2024/12/02/for-the-sec...

The lawyer he retained for this case, Neal Katyal, is not a sympathetic figure to a lot of people: https://newrepublic.com/article/160481/neal-katyal-depravity...
pluginvulns
·2 years ago·discuss
It appears you do not know what is going on with WordPress.

The person who ultimately controls what is included in a release of WordPress is the Release Lead. They are an employee of Automattic. We compiled a list of Release Leads going back to 2019: https://www.pluginvulnerabilities.com/2024/10/10/automattics...

It has been Matt Mullenweg 12 of 15 times. The other Release Leads were Josepha Haden Chomphosy and Matías Ventura, who were Automattic employees at the time.

So Automattic obviously does have control and a veto.
pluginvulns
·2 years ago·discuss
You need to keep reading the rest of what we wrote there. We were not disputing that explanation of a consideration. We are saying there can’t be a consideration in a donation and two employees of Automattic contemporaneously claimed it was donation. Either there wasn’t a donation or there isn’t a valid license agreement.

You also didn't address the other issues at all.
pluginvulns
·2 years ago·discuss
We don't have any questions, but there are possibly several inaccuracies in the post you wrote. At least the information appears to contradict other information provided on your side.

The post has been updated to say that "The Foundation also licensed the name to the website WordPress.org, which facilitates widespread access to WordPress-related software at no charge." Websites presumably can't have trademark licenses. There must be a legal entity. Matt Mullenweg is claiming that he personally has the second license for the trademark [1], so not a website. A graphic included in the post similarly still claims that "Right to use name as part of non-profit activities" went to WordPress. With the arrow coming from the WordPress Foundation. There doesn't appear to be a non-profit.

The post states that "The right to use the WordPress marks for commercial purposes (e.g., selling software, hosting, and agency services) is owned by Automattic." The publicly available license states that Automattic has the right to use the trademark "in connection with the hosting of blogs and web sites [2]." So it looks like Automattic's rights are more limited. Maybe the license has been amended or there is an unstated belief that the license has a wider scope than the plain language of the license suggests. Having the foundation release all licenses agreements it has would help to clear things up, possibility for you, but definitely for everyone else.

In explaining how the license agreement between the foundation and Automattic happened, the post says that 'In order to effect a valid license agreement, there needs to be an actual exchange of value from both sides, which lawyers call "consideration."' But Matt Mullenweg [3] and what appears to be an Automattic employee writing for the WordPress Foundation [4] both stated at the time that Auomattic donated the trademark. Legally, a donation can't involve a consideration [5]. That would suggest there isn't a valid license agreement or there wasn't actually a donation.

We would suggest you consult with a lawyer about all that, but you are a lawyer.

[1] https://youtu.be/OUJgahHjAKU?t=442 [2] https://assignments.uspto.gov/assignments/assignment-tm-4233... [3] https://ma.tt/2010/09/wordpress-trademark/ [4] https://wordpressfoundation.org/news/2010/trademark/ [5] https://www.law.cornell.edu/wex/donation
pluginvulns
·2 years ago·discuss
Here is the original source for the claim, which is on Automattic's website: https://automattic.com/2024/10/02/wordpress-trademarks-a-leg...

The author is identified as Neil Peretz, who it says is an associate general counsel at Automattic. He says:

"The Foundation also licensed the name WordPress to the non-profit WordPress.org, which runs a website that facilitates access to WordPress-related software."

A graphic included in the post similarly claims that "Right to use name as part of non-profit activities" went to WordPress. With the arrow coming from the WordPress Foundation.

We contacted Automattic's press email for clarification on that claim on Thursday. We have yet to hear back and the post hasn't been updated.
pluginvulns
·2 years ago·discuss
WordPress.org seems to be used to refer to Matt Mullenweg [1], as he apparently personally owns it, though one of Automattic's lawyers said last week that it is a non-profit that is separate from the WordPress Foundation [2].

The previous Executive Director of WordPress was also an Automattic employee. When they were announced in the role their employment with Automattic also wasn't disclosed [3].

[1] https://www.pluginvulnerabilities.com/2024/10/02/who-or-what... [2] https://www.pluginvulnerabilities.com/2024/10/03/automattic-... [3] https://make.wordpress.org/updates/2019/01/16/expanding-word...
pluginvulns
·2 years ago·discuss
Matt Mullenweg has said that the WordPress Foundation, which is separate from WordPress.org (it gets confusing), could revoke the licenses that he (personally?) and Automattic have.

The public license agreement that Automattic has says the license is "perpetual, irrevocable:" https://www.pluginvulnerabilities.com/2024/10/02/matt-mullen...

The license that exists for WordPress.org, which seems to really be just him, doesn't appear to be public. It would be interesting to see who it really is with and what the terms really are.
pluginvulns
·2 years ago·discuss
The program is called Five for the Future: https://wordpress.org/five-for-the-future/