This is a surprising confidence shared by a member of the WordPress core team. He told me that redistributing an extension retrieved from a server is perfectly legal. The CMS’s fundamental rules allow this use. While the general public is unaware of it, premium solution publishers take advantage of this lack of knowledge to protect their business model. Our investigation sheds light on these legal provisions.
In this article
- Every WordPress plugin is necessarily covered by the GPL license
- Publishers sell a service, not the code
- Modifying a plugin for personal use is a GPL right
- The split license tries to bypass the GPL without succeeding
- WP Engine discovered that the GPL can also be used as a weapon
- Developing a serious plugin takes years
- The GPL does not cover moral rights or counterfeiting
- Installing a forked plugin can have very different consequences
Every WordPress plugin is necessarily covered by the GPL license
WordPress is distributed under the GNU GPL v2 (GNU General Public License). Created by the Free Software Foundation, this license grants four fundamental freedoms to anyone who receives the software.
- Use the software for any purpose.
- Study how it works and modify it.
- Redistribute copies.
- Distribute modified versions.
The GPL is a copyleft license. Any software derived from GPL code automatically inherits the same license. A WordPress plugin uses WordPress internal functions (hooks, filters and APIs), runs in the WordPress environment and interacts with its database. It is considered a derivative work and must therefore be GPL-licensed.
This is the official position of WordPress.org and the Free Software Foundation, legally confirmed during the Thesis controversy in 2010. Matt Mullenweg forced publisher Chris Pearson to release his commercial theme under the GPL after weeks of public confrontation. The same mechanism resurfaced in 2024 in the WP Engine dispute.
Publishers sell a service, not the code
A publisher can sell WP Rocket for €59 per year. It can sell Elementor Pro for €99. It can sell Advanced Custom Fields at any price. But it cannot prohibit redistribution of the code. The GPL gives it no such right.
It does not sell the software, but the license key that provides access to automatic updates and support. Once the code is in your hands, it belongs to you under the GPL. You can copy it, modify it and give it to someone else.
That is exactly what GPL resellers (GPLDL, GPL Vault and others) do. They buy an official license, download the plugin and redistribute it to their customers at a lower price. Legally, they are doing nothing forbidden. The license they bought gives them that right. The difference from a site distributing an anonymous fork is that the distributed file is the original and has not been modified.
Modifying a plugin for personal use is a GPL right
The GPL allows you to use, study, redistribute and modify software. The exact text of GPL 2 states that you may modify your copy and distribute those modifications, provided that you make the source code available. A plugin from which the license check has been removed is technically a source-code modification. The GPL allows it.
Saying that a fork is illegal is therefore false. The law says that modifying and then redistributing software without providing the source code violates the GPL. Modifying it for personal use, or modifying it while making the code available, is within the rights that the license explicitly grants.
A fork redistributed without source code already violates the GPL.
When someone modifies a plugin to remove a license check and then publishes it for free, there is no proof that they stopped there. The modification may also have added a backdoor, a data-collection script or a redirect to an external server. You cannot know without auditing the code line by line. According to Wordfence’s 2024 report on malicious plugins, 52% of fork distribution sources inject malicious code into the files.
If you have the skills to audit the code yourself, a fork whose every line you have checked is not dangerous. The patterns to look for first in an unknown PHP file are eval(base64_decode(...)), wp_remote_get calls to undocumented external URLs and add_action calls that inject scripts into wp_head for third-party domains. If you do not spot these patterns, you are installing an unknown file with full execution rights on your server.
| GPL reseller (original file) | Fork (modified file) | |
|---|---|---|
| Code modification | None | At least the license check has been removed |
| Legal under the GPL | Yes | Yes if source code is provided, otherwise personal use is a grey area |
| Malware risk | None (original file) | Depends on the source, 52% of cases according to Wordfence 2024 |
| Automatic updates | Absent | Absent |
| Auditable without skills | Yes (known file) | No (a diff is impossible without the original) |
The split license tries to bypass the GPL without succeeding
Some publishers have tried to bypass this obligation by creating a split license. PHP is released under the GPL (a legal obligation), while CSS, JavaScript, images and other assets remain under a proprietary license.
Matt Mullenweg clearly rejected this approach in a 2015 post titled “There is No Such Thing as a Split License“. Once assets are necessary for the plugin to work, they are part of the derivative work and fall under the GPL. The split license is a legal attempt to bypass the rules that WordPress.org rejects for every plugin or theme listed in its official directory. Outside the official directory, nothing legally prevents a publisher from trying this arrangement, but it may face challenges.
In practice, almost all major plugin publishers have moved to 100% GPL since 2015. The split license is now marginal and viewed as a poor practice in the WordPress community.
WP Engine discovered that the GPL can also be used as a weapon
In September 2024, Matt Mullenweg published a post against WP Engine, accusing the host of generating substantial revenue from WordPress without contributing enough to the project. The dispute escalated quickly.
In October 2024, WordPress.org took control of the Advanced Custom Fields (ACF) plugin, owned by WP Engine and used by more than 2 million sites. The plugin was forked under the name Secure Custom Fields. The stated justification was that ACF was in the WordPress.org directory under the GPL, so it could be forked at any time. Legally, that is correct.
WP Engine sued Automattic and Mullenweg in California for abuse of power. In December 2024, a preliminary injunction required Automattic to restore WP Engine’s access to WordPress.org. A year later, on December 10, 2025, federal judge Araceli Martínez-Olguín ordered Automattic to return the Secure Custom Fields plugin and delete tracking data collected from WP Engine customers. In February 2026, WP Engine produced internal documents suggesting that Automattic had planned to impose royalties on 10 competing hosts. The jury trial is scheduled for September 2027.
Advanced Custom Fields, acquired by WP Engine, could be forked overnight because its code was under the GPL. The lawsuit does not change that right. The court may order Automattic to restore access to its infrastructure. It cannot prohibit the code from existing under the GPL.
Developing a serious plugin takes years
The GPL authorizes redistribution. That does not mean the work behind a premium plugin has no value.
WP Rocket has been a full-time development team since 2013. Every major WordPress update can break entire optimizations. Cache rules change, new APIs appear and browsers evolve. Keeping a performance plugin working across thousands of different hosting, theme and plugin configurations is ongoing work.
When you use a GPL reseller for €5 instead of paying for the official license, you are using the code legally. But you are not helping fund future updates. If everyone did this, the teams maintaining these tools would no longer have the resources to continue. The GPL guarantees your rights. It does not guarantee that someone will be paid to keep improving the software.
Don’t let the algorithm decide for you
Add Assistouest to your preferred sources on Google so you can find our guides faster when you search for an IT solution.
The GPL does not cover moral rights or counterfeiting
An author’s moral rights are protected in France by Article L.121-1 of the Intellectual Property Code, independently of any license. They are inalienable: even the GPL cannot erase them. Redistributing a plugin after removing the original author’s notice violates those rights. Selling a GPL plugin while claiming to be its author amounts to counterfeiting.
The GPL allows free redistribution. It also requires redistribution under the same conditions. Anyone distributing a modified version must make its source code available.
Installing a forked plugin can have very different consequences
If you install a plugin from a GPL reseller distributing unmodified original files, you are doing nothing illegal. The main risk is the absence of automatic updates, which exposes your site to known security flaws. A plugin that has not been updated for six months on a production site is an open attack surface. The basics of securing a WordPress site cover this issue along with other common attack vectors.
If you install a forked plugin without knowing whether the code was modified, malware is a risk. A backdoor in a plugin installed on your site gives complete access to your database, files and user data. Recovering a site compromised by this kind of injection takes hours and leaves traces in Google Search Console for weeks.
Can a redistributed GPL plugin be used on a client site
Are themes subject to the same GPL rules as plugins?
The content will unlock automatically after verification.