WordPress Implements Automated Security Reviews for Plugin Updates

WordPress is introducing automated security reviews for all plugin releases to prevent malicious code and high-risk vulnerabilities from being distributed via the WordPress.org update API.

While new plugins undergo review before entering the official directory, updates have historically been shipped continuously. This lack of a consistent review step meant that a plugin deemed secure could introduce a backdoor or critical flaw in a subsequent release.

The necessity of this measure was demonstrated on 28 July 2026, when automated systems detected a backdoor in a plugin release with approximately 20,000 active installations. Because the release fell within a security cooldown window, the compromised version was intercepted before it could be distributed to end users.

The Protect The Shire Initiative

The automated review is part of a broader security initiative known as ‘Protect The Shire’. Since June 2026, all WordPress plugins and themes have been subject to a cooldown period—currently set at six hours, reduced from an initial 24 hours—before they are eligible for auto-updates.

During this window, changes in a release are analysed by artificial intelligence (AI) models and Jetpack Scan. The results are cross-verified to produce a security score. If a release receives a high-risk score, distribution is automatically halted without requiring manual intervention from the Plugins Team.

A high-risk score does not always indicate intentional malware; it can also flag inadvertently introduced security flaws. Common patterns that increase a plugin’s risk score include:

• REST, AJAX, or admin-post endpoints lacking capability checks.
• Database queries built without using $wpdb->prepare().
• File paths, uploads, or deletions derived directly from request data.
• The use of unserialize() on request data or remote responses.
• Writing options, user meta, or settings from endpoints accessible to unauthenticated users or subscribers.
• The use of obfuscated, packed, or runtime-evaluated code.

Developer Recourse and Best Practices

When a release is blocked, plugin developers are notified via email detailing the findings. To resolve the restriction, developers must address the identified security issues and publish a new release. If the corrected version falls below the high-risk threshold, it will proceed through the standard cooldown process.

The WordPress Official Plugin Repository Team has urged developers to follow WordPress Coding Standards and use PHP_CodeSniffer (PHPCS) to validate code quality. Developers publishing WooCommerce extensions are specifically encouraged to use the Quality Insights Toolkit (QIT) testing platform.