WordPress Launches Automated Security Reviews for Plugin Updates

WordPress is launching automated security reviews for every plugin release before they are distributed through the WordPress.org update application programming interface (API). The move aims to detect potential security vulnerabilities and malicious code in plugin updates, which currently ship continuously without the same level of scrutiny applied to new plugins.

The initiative addresses a gap in the security lifecycle of the content management system (CMS). While new plugins undergo manual review before entering the official directory, subsequent updates have historically lacked a consistent review step. David Perez, co-lead of the WordPress Official Plugin Repository Team, noted that a plugin can be secure during its initial release but introduce a vulnerability or malicious code in a later version.

Mitigating Supply Chain Risks

The necessity for these automated checks was underscored by a recent discovery involving a plugin with approximately 20,000 active installations. The WordPress Plugins Team was alerted to a backdoor in a plugin release by the security company Wordfence. Because the release fell within a cooldown period established by the “Protect The Shire” security initiative, the compromised version was blocked and never reached end users through the official update API. The plugin was closed for downloads 26 minutes after the team was alerted.

Under the new system, the cooldown period, which was recently reduced from 24 hours to six hours, will be used to perform automated analysis. During this window, artificial intelligence (AI) models and Jetpack Scan will examine the changes in each release to generate a security score.

Automated Blocking and Risk Patterns

Releases that receive a high-risk score will be automatically halted from distribution without the need for manual intervention from the Plugins Team. While a high score does not always indicate intentional malware, it also flags inadvertently introduced security flaws. Developers whose releases are blocked will receive an email with the specific findings.

The automated review identifies several patterns that contribute to a higher risk score, including:

• REST, AJAX, or admin-post endpoints that lack a capability check, noting that a nonce alone does not constitute authorisation.
• Database queries constructed without using $wpdb->prepare().
• File paths, uploads, deletions, or includes built from request data.
• The use of unserialize() on request data or remote responses.
• Code that is obfuscated, packed, or evaluated at runtime.

To resolve a block, developers must review the findings, fix the identified issues, and publish a new release. If the updated version scores below the high-risk threshold, it will proceed through the standard cooldown process. WordPress recommends that developers follow official coding standards and use the Quality Insights Toolkit (QIT) for WooCommerce extensions to maintain code quality.