WordPress is adding a new automated security review system that will check every plugin release before it is distributed to users through the WordPress.org update system. The goal is to catch vulnerabilities, backdoors, and other potentially dangerous code before a compromised update reaches websites.
David Perez, WordPress Official Plugin Repository Team Co-Lead, said plugins are reviewed before they are first added to the directory, but updates can continue to be released without the same level of review. That creates a potential gap where a plugin that is safe today could introduce a vulnerability or malicious code in a later release.
WordPress said the new system is designed to close that gap by adding a consistent security check between a developer committing a new release and that release being distributed to users.
The need for the system became clear on July 28, 2026, when an automated review detected a backdoor in a plugin release with around 20,000 active installations. Because the release was still inside the security cooldown period, the compromised version was never distributed through the WordPress.org update API. WordPress did not reveal the name of the plugin.
The Plugins Team was alerted to the suspicious update by WordPress security company Wordfence, and the plugin was closed for downloads 26 minutes later.
The automated review is part of WordPress’ broader Protect The Shire security initiative. Since June 5, 2026, every plugin and theme release has gone through a cooldown period before being made available through automatic updates. The cooldown was originally 24 hours but has since been reduced to six hours.
During this period, WordPress.org will analyze changes in a release using artificial intelligence models together with Jetpack Scan. The results are then cross-checked and combined into a security score designed to indicate the potential risk of the release.
If the score reaches the high-risk threshold, WordPress will automatically block the release after the review is completed. Releases that remain below the threshold will continue through the normal distribution process.
Developers will also receive information about the security findings, although WordPress says emails are sent only when a release has been blocked.
A high-risk score does not automatically mean that a developer intentionally added malicious code. WordPress says the system is also designed to detect security vulnerabilities that may have been introduced accidentally, meaning a release can be flagged even when there is no evidence of malicious intent.
The review looks for many of the same types of problems that would normally be examined during a security audit. WordPress has encouraged developers to follow its coding standards and use PHP_CodeSniffer rules to check code quality. Developers creating WooCommerce extensions are also encouraged to use the Quality Insights Toolkit for testing.
Certain coding patterns can increase a release’s risk score. These include REST, AJAX and admin-post endpoints that do not properly check user capabilities, database queries that are not protected with $wpdb->prepare(), and file operations or includes that use data supplied through requests.
The system can also flag potentially dangerous uses of unserialize() on request data or remote responses, settings or user information that can be modified through endpoints accessible to unauthenticated users or subscribers, and code that is downloaded or executed at runtime. Obfuscated or packed code can also contribute to a higher risk score.
When a release is blocked, developers must review the findings, fix the identified problems and publish a new version. If the new release receives a score below the high-risk threshold, it can move forward through the normal cooldown process.
Perez said developers who believe a finding is incorrect can contact the Plugins Team, but warned that manual reviews can take time because the team handles a large volume of cases. In most situations, fixing the reported issue and publishing a new release will be faster than waiting for an appeal.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The new system gives WordPress another layer of protection against compromised plugin and theme updates. Instead of relying entirely on manual intervention after a suspicious release is discovered, potentially dangerous updates can now be stopped automatically before they reach users.
