The ACF Plugin Update Controversy: What You Need to Know

In October 2024, WordPress.org replaced the Advanced Custom Fields (ACF) plugin in its plugin directory with its own fork called Secure Custom Fields. The dispute between Matt Mullenweg and WP Engine, the owner of ACF, left many site owners unsure what to do. This post explains what happened, where things stand today and what you should do with your website.

Status 2026: ACF and Secure Custom Fields, what site owners should do today

Last reviewed: 7 October 2026, checked against the WordPress.org plugin directory.

Today there are two separate plugins in the official directory:

• Advanced Custom Fields (ACF®) is back at its original address, with WP Engine listed as the author. The current version, 6.8.10, is dated 10 September 2026. The ACF developers once again publish their updates directly through WordPress.org.
• Secure Custom Fields (SCF) has been a separate plugin at its own address since November 2024, with WordPress.org listed as the author. The current version is 6.9.5.

The ACF listing was handed back to WP Engine in December 2024 following a preliminary injunction by a US court, as reported by WP Tavern, among others.

What this means for your website:

1. Check which plugin is installed. The plugin list in your WordPress admin shows the author next to the name. "Advanced Custom Fields" by WP Engine is the original, "Secure Custom Fields" by WordPress.org is the fork. Sites that updated automatically in October 2024 may still be running SCF without anyone noticing.
2. Choose one of the two. Running both at once doesn't work: according to its directory description, SCF deactivates ACF and ACF PRO on installation to avoid code conflicts. If you have an ACF PRO licence, you get PRO updates from WP Engine and will usually stay with ACF.
3. Keep your chosen plugin up to date. According to the changelog in the directory, ACF version 6.8.10 contains seven security fixes. An outdated custom fields plugin is an unnecessary risk.
4. Test a switch first. If you want to move from SCF back to ACF or the other way round, try it on a staging copy first and then check the fields on your most important pages.

If you'd rather not follow developments like this yourself: that is part of my WordPress support. I test plugin updates on a staging environment before rolling them out instead of letting them run automatically.

What happened in October 2024

On 12 October 2024, the ACF team reported that WordPress.org had taken over the plugin's listing (statement on advancedcustomfields.com). A modified version called "Secure Custom Fields" was delivered under ACF's address. Matt Mullenweg had initiated this without the consent of the ACF team, which has developed the plugin since 2011.

As a result, sites updating the free version of ACF via WordPress.org suddenly received code that the ACF team was no longer responsible for. WP Engine stated at the time that ACF PRO customers and WP Engine and Flywheel hosting customers were not affected. Everyone else was advised to download version 6.3.8 once from advancedcustomfields.com to get updates from the original again. That workaround was necessary as long as ACF could not be distributed through WordPress.org.

Why the case mattered to the community

The WordPress ecosystem relies on developers distributing their plugins through the official directory and keeping control of their code there. Taking over an actively maintained plugin without its developers' consent was unprecedented. Many called it a "hostile takeover", some even a kind of supply-chain attack, because users received a different plugin via an update than the one they had installed.

For developers who build sites with ACF, it was a practical problem: ACF is part of many themes and custom solutions. Anyone who didn't know which version ran on which client site had to check.

What remains

The case showed that for important plugins you should know where the updates come from. Automatic updates are convenient, but for plugins an entire website depends on, a quick check before installing them pays off. The 2026 steps above are a good routine regardless of ACF.