WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved.
"New plugins are reviewed before they enter the directory, but updates ship continuously after that," David Perez, WordPress Official Plugin Repository Team Co-Lead, said. "A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release."
WordPress said the lack of a "consistent review step" between the commit of a release and the release of a plugin to downstream users meant that it could open the door for malicious attacks.
The content management system (CMS) platform noted that its automated review detected a backdoor committed to a release of a plugin with about 20,000 active installations on July 28, 2026. Because the release was within a cooldown window, the compromised version of the plugin never ended up getting distributed through the WordPress.org update API.
The plugin was closed for downloads 26 minutes after the Plugins Team was alerted to the update by WordPress security company Wordfence. WordPress did not disclose the name of the plugin.
Since June 5, 2026, every WordPress plugin and theme goes through a cooldown period before being distributed through auto-updates as part of a new security initiative called Protect The Shire. The idea is to introduce some friction to the process so that malicious updates do not reach end users immediately. The cooldown period is currently at six hours, down from 24 hours when it was first introduced.
The latest effort aims to close another critical security gap: a high-risk score for a plugin or theme release should automatically halt distribution without involvement from the Plugins Team. The entire process goes through the following steps -
- During the cooldown period, the changes in each release are analyzed in WordPress.org by artificial intelligence (AI) models along with Jetpack Scan.
- Results are cross-verified and combined into a security score: A higher score translates to a potentially higher risk.
- Releases with a high risk score are blocked automatically once the review completes, while those below that threshold will continue the normal process.
- Plugin committers receive an email with the findings. Emails are only sent in scenarios where a plugin is blocked.
That said, it's worth noting that a high risk score does not necessarily indicate malicious intent, as the score also takes into account inadvertently introduced security flaws just as it flags intentional malware.
In a follow-up comment, Perez elaborated that the security review "looks for the same vulnerability classes any security audit looks for," urging developers to follow WordPress Coding Standards and PHP_CodeSniffer (PHPCS) rules to validate their code and ensure code quality. Developers publishing WooCommerce extensions are recommended to use the Quality Insights Toolkit (QIT) testing platform.
Other patterns that could also drive the risk score up are below -
- REST, AJAX or admin-post endpoints without a capability check (a nonce alone is not authorization)
- Queries built without $wpdb->prepare()
- File paths, uploads, deletions or includes built from request data
- unserialize() on request data or on a remote response
- Options, user meta or settings written from endpoints reachable by subscribers or unauthenticated users
- Code fetched or evaluated at runtime, and obfuscated or packed code
Once a release is blocked, the only way for the developer to get the restrictions removed is to review the findings, fix the issues, and publish a new release. Should the new release score below the high-risk threshold, it continues through the normal cooldown process.
"If a finding looks incorrect, authors can contact the Plugins Team," Perez said. "Please understand that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual review of an appeal."
