WordPress adds automated security checks to block risky plugin releases
WordPress.org now automatically security-reviews every plugin release and blocks high-risk updates before distribution to millions of sites.
The WordPress Official Plugin Repository Team launched an automated security review that scores each plugin and theme release during a six-hour cooldown, combining analysis from several AI models and Jetpack Scan, and automatically blocks releases deemed high risk. The change followed a July 28 detection of a backdoor committed to a release of a plugin with roughly 20,000 active installations; the release was withheld and the plugin closed for downloads 26 minutes after Wordfence notified the team. Blocked authors must fix findings and publish a new release scoring below the blocking threshold, or appeal to the Plugins Team.
- Every WordPress.org plugin release now passes an automated security review with a risk score before distribution.
- A six-hour cooldown holds all releases, including one-click dashboard updates, since June 5.
- AI models and Jetpack Scan cross-check release changes to reduce false positives.
- A July 28 backdoor in a plugin with ~20,000 installs was blocked before reaching users.
- Authors can appeal a block, but publishing a fixed release is usually faster.
- Vendors
- WordPressAutomatticWordfence
- Organizations
- WordPress Official Plugin Repository Team
From the original article
2 min read at helpnetsecurity.com
WordPress’ automated security review will now assess every plugin release before it is distributed through the WordPress. org update API. Releases considered a potential security risk will be blocked automatically.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.