WordPress has introduced an automated security review process for plugin releases to identify potential security issues before updates are distributed through the WordPress.org update API. The new system is designed to add an additional layer of protection by analyzing every plugin release for risks that could affect millions of websites using the platform. Previously, new plugins were reviewed before being added to the WordPress directory, but updates released after approval could move through the distribution process without a consistent security review step. David Perez, WordPress Official Plugin Repository Team Co-Lead, explained that a plugin could remain secure at one point but later introduce vulnerabilities or unintended malicious code through a future update. WordPress said the absence of a review checkpoint between a release commit and its availability to users could create opportunities for security issues to reach website owners.
The platform revealed that its automated review process successfully detected a backdoor added to a plugin release with approximately 20,000 active installations on July 28, 2026. Since the release was identified during a cooldown period, the affected version was prevented from being distributed through the WordPress.org update API. WordPress did not reveal the plugin name, but confirmed that the plugin was removed from downloads 26 minutes after the Plugins Team received a notification from WordPress security company Wordfence regarding the suspicious update. The automated review system builds on WordPress Protect The Shire security initiative, which introduced a cooldown period for plugin and theme releases before they become available through automatic updates. Since June 5, 2026, all WordPress plugins and themes have gone through this process to create additional time for security checks before updates reach end users. The cooldown period was initially introduced as a 24-hour delay and was later reduced to six hours. During this period, release changes are analyzed using artificial intelligence models along with Jetpack Scan to identify possible security concerns.
WordPress combines the results from these security checks into a risk score, where higher scores indicate releases that may require further attention. Releases identified with a high risk score are automatically blocked after the review process, while updates below the risk threshold continue through the standard distribution process. Plugin developers receive email notifications when their releases are blocked and are provided with findings that explain the security concerns identified during analysis. The company clarified that a high risk score does not always mean a release contains intentional malicious activity. The scoring system is also designed to identify accidentally introduced vulnerabilities and insecure coding practices that could create security risks. Perez noted that the automated review looks for vulnerability categories commonly examined during security audits and encouraged developers to follow WordPress Coding Standards and PHP CodeSniffer rules to maintain secure code quality. Developers creating WooCommerce extensions are also recommended to use the Quality Insights Toolkit testing platform for additional validation.
Several coding patterns can increase a plugin release security risk score, including REST, AJAX or admin-post endpoints without proper capability checks, database queries created without $wpdb->prepare(), file operations based on user-controlled input, unsafe use of unserialize() with request data or remote responses, and settings changes through endpoints accessible to unauthorized users. Runtime code execution, downloaded code, obfuscated scripts and packed code can also contribute to a higher risk assessment. If a plugin release is blocked, developers must review the findings, address the identified concerns and submit a new release. Once the updated version receives a lower risk score, it can proceed through the normal cooldown process before distribution. Perez added that developers who believe a finding may be incorrect can contact the Plugins Team, although publishing a corrected version is generally expected to be faster than waiting for a manual review process due to the team handling a large volume of requests.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
