WordPress.org puts every plugin release behind an AI-scored security gate as Automattic's CEO ouster unravels

WordPress.org now runs all plugin and theme releases through a mandatory six-hour cooldown in which multiple AI models plus Jetpack Scan produce a risk score, automatically blocking high-risk updates before distribution — a system spurred by a July 28…

Since June 5, 2026, every WordPress.org plugin and theme release — including one-click dashboard updates — has passed an automated security review during a six-hour cooldown, with multiple AI models and Jetpack Scan cross-checking code changes to produce a consolidated risk score; releases above the blocking threshold are automatically held back from the WordPress.org update API. The gate followed a July 28, 2026 incident in which a backdoor was committed to a release of a plugin with roughly 20,000 active installations: Wordfence flagged it, the Plugins Team withheld the release and closed the plugin for downloads 26 minutes later, so it never reached users. Blocked authors receive an email with findings and can either publish a corrected release scoring below the threshold or appeal to the Plugins Team; the project notes scores measure risk exposure, not developer intent, and requests false-positive reports. Separately, on Wednesday, September 9, 2026, Automattic's board voted — over Mullenweg's dissent — to place him on paid leave and appoint CFO Mark Davies interim CEO, a move confirmed at the time by a company spokesperson; the WordPress.org executive director said the open-source project and its teams continue as planned and are unaffected. On Friday, September 11, 2026, Mullenweg announced in company-wide Slack that the board was 'back in agreement' and he was in control, employee sources reported Davies' Slack account was deactivated and Slack admins were removed, but Automattic has not formally confirmed his return and the board has communicated nothing beyond Wednesday's message, leaving the situation fluid.

• Every WordPress.org plugin and theme release has passed a mandatory six-hour cooldown with automated security review since June 5, 2026, including one-click dashboard updates.
• Multiple AI models plus Jetpack Scan analyze release changes and produce a consolidated risk score; releases above the threshold are automatically blocked from the WordPress.org update API until issues are resolved.
• The system followed a July 28, 2026 backdoor committed to a release of a plugin with roughly 20,000 active installations; the release was withheld and the plugin closed for downloads 26 minutes after Wordfence notified the team, so it was…
• Blocked authors are emailed findings and can publish a corrected release below the blocking threshold (usually faster) or appeal to the Plugins Team.
• On September 9, 2026, Automattic's board voted to place founder and CEO Matt Mullenweg on paid leave against his will (he voted against it) and named CFO Mark Davies interim CEO; Mullenweg remains on the board.
• On September 11, 2026, Mullenweg claimed in company-wide Slack that the board was 'back in agreement' and he was in control, less than 48 hours after the leave was announced; employee sources said Davies' Slack account was deactivated and…
• Mullenweg has publicly suggested Silver Lake, majority owner of WP Engine — which is suing Mullenweg and Automattic — was involved in the ouster; Automattic's prior turmoil includes a 2024 ultimatum in which 159 employees took severance…
• Automattic also owns Tumblr, WooCommerce, and Pocket Casts; WordPress.org's executive director said the open-source WordPress project and its teams continue as planned and are not impacted.