WordPress has introduced an automated, AI-powered security review process for every plugin release, aiming to stop vulnerable or malicious updates before delivering them to millions of websites through the platform’s update infrastructure.
The new control analyzes plugin releases before they become available through the WordPress.org update API, including updates installed directly from the WordPress dashboard.
Releases identified as posing a potentially high security risk will now be blocked automatically rather than relying on manual intervention by the Plugins Team.
WordPress Launches AI-Powered Security Review
The initiative addresses a longstanding supply-chain security gap in the WordPress ecosystem. While new plugins receive an initial review before entering the official directory, developers can continuously ship later updates.
A plugin that is secure at publication can subsequently introduce a coding flaw, a compromised dependency, or deliberately implanted malicious functionality.
WordPress said the capability builds on a cooldown mechanism introduced on June 5 for plugin and theme releases. WordPress holds every release before distribution through the update API; the current cooldown window is six hours.
The delay gives automated systems time to inspect code changes before they reach active installations. During that period, WordPress.org evaluates each release using multiple AI models and Jetpack Scan.
The tools cross-check findings and consolidate them into a security score. A higher score indicates a greater potential security risk, though it does not determine whether suspicious code was added maliciously or unintentionally.
A newly introduced authentication bypass, unsafe file-upload handler, remote code execution condition, obfuscated code loader, credential-stealing routine, or hidden backdoor could all generate a high-risk result.
The automated score measures the security impact and likelihood of abuse, not the developer’s intent. WordPress said it uses several analysis systems to increase detection accuracy and reduce false positives, though it acknowledged that false alerts remain possible.
Releases that fall below the blocking threshold will proceed through the standard cooldown and distribution process. High-risk releases, however, are automatically prevented from reaching the WordPress.org update API once the security review is completed.
All listed plugin committers receive an email containing the findings that triggered the block. Developers whose releases are not blocked will not receive a notification and do not need to take action.
The change follows an incident on July 28 involving a plugin with roughly 20,000 active installations. A backdoor was committed in a release, but automated review assigned it a high security score while it was still within the cooldown period.
As a result, WordPress never distributed the compromised version through the update API. WordPress said the plugin was closed for downloads 26 minutes after the Plugins Team received a notification from Wordfence.
For blocked releases, WordPress recommends that authors first examine the reported findings, remediate the issue, and publish a new version. If the replacement release scores below the blocking threshold, it will continue through the normal cooldown workflow.
Plugin authors can contact the Plugins Team if they believe a detection is inaccurate. However, WordPress cautioned that manual reviews may take time because of review volume, making a corrected release the fastest route to restoring update distribution.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
