WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.
WordPress announced automated security reviews for every plugin release during its cooldown period before distribution through the WordPress.org update API, combining AI models with Jetpack Scan into a security score. The system already caught a backdoor committed to a plugin with about 20,000 active installations on July 28, 2026, blocking it within 26 minutes of a Wordfence alert. Flagged patterns include missing capability checks, unsafe $wpdb queries, unserialize() on request data, and obfuscated code.
- High-risk-score releases are automatically blocked from distribution
- Caught a backdoor in a plugin with ~20,000 installs on July 28, 2026
- Cooldown period now six hours, down from 24, under Protect The Shire initiative
- Flags missing capability checks, unsafe queries, unserialize(), and obfuscated code
From the original article
3 min read at thehackernews.com
WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress. org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," David Perez, WordPress Official Plugin
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.