A New Gate Before Every Release
WordPress has rolled out an automated security review that scans every plugin release before it reaches the WordPress.org update API, aiming to catch vulnerabilities and malicious code before they ever land on a production site. Previously, plugin code review focused heavily on initial submission — a plugin could pass its first review clean and later ship a compromised update with no equivalent scrutiny.
How the Review Works
Each new release now sits in a cooldown window (currently six hours) before it becomes available to end users. During that window:
- AI models and Jetpack Scan analyze the code changes introduced in the release
- Their findings are cross-verified and combined into a single security risk score
- Releases that score as high-risk are automatically blocked — no human has to intervene for the block to take effect
- Developers are notified by email only when a release is blocked, with details on what triggered it
What the Scanner Looks For
| Risk Pattern | Description |
|---|---|
| Missing capability checks | REST, AJAX, or admin endpoints with no permission checks |
| Unsafe SQL | Queries built via string concatenation instead of prepared statements |
| Unsafe file operations | File paths or operations built from unsanitized user input |
| Unsafe deserialization | Deserializing user-supplied data without validation |
| Unauthorized data access | Code reaching into other users' options or user metadata |
| Runtime code fetching | Remotely fetched or obfuscated code executed at runtime |
Already Working
The system has already demonstrated real-world value. On July 28, 2026, it flagged a backdoor inserted into a plugin with roughly 20,000 active installations — the compromised release was pulled from distribution within 26 minutes of publication, before it could reach a meaningful share of that install base.
David Perez, co-lead of the WordPress Official Plugin Repository Team, summed up the rationale: "A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release."
Why This Matters
WordPress powers a substantial share of the web, and its plugin ecosystem has long been a favored supply-chain target — compromised or vulnerable plugin updates have repeatedly been used to mass-inject malware, backdoors, and SEO spam across thousands of sites at once. Gating every release, not just initial submissions, closes a gap that attackers have historically exploited: hijacking a trusted, already-installed plugin's update channel rather than trying to get a malicious plugin approved from scratch.
What This Means for Site Owners
- Plugin updates may occasionally arrive later than before due to the review cooldown
- A blocked update should be treated as a signal to check with the developer before assuming it's safe to install manually
- This does not replace basic hygiene: keep plugins to the minimum needed, remove unused ones, and monitor for unexpected admin users or file changes regardless of the update source