WordPress Plugin Review Team

Brad Chant

Hopefully this is a fresh start. Bias and patronising behaviour was common in the plugin review team before most of them left

Those are great questions, and learning from this situation is something that should happen. From what we have seen from the outside, it looks like the answers can be summed up in large part by WordPress’ lack of proper governance.

A group of people got in charge of the team, who to put it politely, shouldn’t have even been on the team. These were people that were unable to deal with being wrong and unable to understand that they didn’t know everything. They then blocked anyone else from even applying to join the team and refused outside help to address the problems they were creating.

While the problems with the team were very evident, there hasn’t been someone with oversight of the team that others could go to get the problems with the team addressed. So the problems were allowed to continue for years, until, for unclear reasons, the head of the team left. The lack of oversight unfortunately doesn’t look to have changed.

Making the situation worse, those people seem to be protected in the WordPress community, so there was largely silence about the problems. The WP Tavern, for example, has covered the new team multiple times, but ignored the team for years before that despite the ongoing problems being brought to their attention. The same is true for other outlets that cover WordPress. Those trying to civilly raise the issues were criticized for doing that. Bringing up the problems behind the scenes with the companies sponsoring the problematic team members was also ignored. The team members also have controlled the WordPress support forum and shut down attempts to discuss the problems there as well.

Hopefully, things are moving in the right direction now with the new team members, but so far, things are still not in great shape. Earlier this week, we found that a plugin with a publicly known vulnerability likely to be exploited is still available in the plugin directory, despite the company run by the head of WordPress having publicly claimed nearly a month before that the vulnerability existed. If the new team is actually interested in getting things right, working with us and others who have tried to help the team in the past would be an easy way to make things better.