WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review
WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.
WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.
- Every plugin update is analyzed by multiple AI models plus Jetpack Scan during a six-hour cooldown
- Updates exceeding the risk threshold are automatically blocked from the WordPress.org update API
- Follows a July 28 backdoor in a plugin with ~20,000 active installs, blocked before delivery
- Plugins Team removed the compromised plugin 26 minutes after Wordfence notification
- Blocked authors receive findings emails and can publish corrected releases
From the original article
2 min read at gbhackers.com
WordPress has launched an automated security review system that uses multiple AI models and Jetpack Scan to analyze every plugin release before distributing it to websites via the WordPress. org update API. This new control is designed to prevent vulnerable or malicious plugin updates from reaching millions of WordPress installations through dashboard-based, one-click updates.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.