WordPress Automates Plugin Security Checks

WordPress has announced the launch of an automated security review system that scans every plugin update before it is distributed through the WordPress.org update API. The move addresses a critical vulnerability in the platform's update process, where new plugins were previously vetted but subsequent updates were often shipped without consistent security checks. This creates a window of opportunity for attackers to inject malicious code or introduce severe vulnerabilities into popular extensions.

According to David Perez, co-lead of the WordPress Official Plugin Repository Team, the absence of a standardized review step between a code commit and its release to end users allowed compromised versions to propagate rapidly. The new system aims to intercept these threats by analyzing code changes in real-time, ensuring that even established plugins cannot silently degrade in security after their initial approval.

AI Models Halt Risky Updates

The new process integrates artificial intelligence models with Jetpack Scan to analyze code changes during a mandatory cooldown period. These tools generate a security score for each release, where a higher score indicates greater potential risk. If a release exceeds a specific high-risk threshold, the system automatically blocks its distribution without requiring manual intervention from the WordPress team. This automation ensures that dangerous updates are stopped quickly, regardless of the time of day or the volume of submissions.

The system is already proving effective. In late July 2026, the automated review detected a backdoor in a plugin with approximately 20,000 active installations. Because the release fell within the cooldown window, the compromised version never reached end users. The plugin was closed for downloads just 26 minutes after the alert, a response time that would have been difficult to achieve with manual review alone, as reported by The Hacker News.

Trade-Offs for Plugin Developers

While the enhanced security protects users, it introduces friction for developers. A high risk score does not always indicate malicious intent; it can also flag inadvertently introduced security flaws. However, once a release is blocked, the developer must review the findings, fix the issues, and publish a new version to proceed. There is no fast-track appeal process. Developers are advised to follow WordPress Coding Standards and use tools like PHP_CodeSniffer to validate their code before submission to avoid unnecessary blocks.

Common patterns that trigger high risk scores include endpoints missing proper capability checks, database queries built without prepared statements, and the use of unsafe functions like unserialize on user data. Developers who believe a finding is incorrect can contact the Plugins Team, but they must account for high review volumes. This shift prioritizes user safety over rapid deployment, requiring developers to maintain stricter code quality standards to ensure their updates pass the automated gate.