WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites
WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.
Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.
- Six-hour cooldown plus multi-model AI review now gates all WordPress.org plugin and theme updates.
- High-score releases are blocked automatically from the update API until issues are resolved.
- Triggered by a July 28, 2026 backdoor incident in a plugin with about 20,000 installs.
- Scores measure risk exposure, not developer intent; false-positive reports requested.
- Products
- WordPressJetpack Scan
- Organizations
- WordPress.orgWordfence
From the original article
3 min read at cybersecuritynews.com
WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress. org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.