WordPress.org is adding automated security checks to plugin and theme releases before they reach websites through its update API. The move follows the discovery of a backdoor in a plugin used by about 20,000 sites. High-risk releases can now be blocked automatically, reducing the chance that harmful code reaches users while developers are offline.
Key takeaways
- Every WordPress.org plugin and theme release enters a six-hour cooldown.
- AI models and Jetpack Scan combine their findings into a security score.
- High-risk releases are blocked automatically rather than waiting for manual action.
- The system cannot update sites that remain on vulnerable versions.
- Premium plugins distributed outside WordPress.org are not covered by the process.
This is an important improvement, but it is not a replacement for a reliable WordPress maintenance plan. Website owners still need regular updates, backups and monitoring after a release becomes available.
Why WordPress introduced the change
New plugins are reviewed before entering the WordPress directory, but updates have traditionally been released continuously. That created a gap in which a trusted plugin could receive vulnerable or malicious code and potentially distribute it to millions of websites.
The issue became clear on 28 July 2026, when an automated check identified a backdoor in a release of an unnamed plugin with roughly 20,000 active installations. WordPress.org did not distribute the version through its update API, although the plugin was closed for downloads 26 minutes after Wordfence alerted the Plugins Team.
The new automatic block is intended to remove that dependence on someone being available to respond manually.
How the review process works
WordPress began placing plugin and theme releases in a cooldown period on 5 June under its “Protect The Shire” initiative. The waiting period is currently six hours, reduced from an initial 24 hours.
During that time, several AI models and Jetpack Scan examine the changes. Their results are cross-checked and converted into a security score:
- A high score causes the release to be blocked.
- Lower-risk releases continue through the normal process.
- Plugin committers receive findings by email when a release is blocked.
A high score does not automatically prove malicious intent. It can also indicate an accidental vulnerability or unsafe coding practice. WordPress says developers should follow its Coding Standards and use PHP_CodeSniffer. WooCommerce extension developers are also encouraged to use the Quality Insights Toolkit.
What developers should watch for
The checks look for common security weaknesses, including missing permission checks on REST or AJAX endpoints, unsafe database queries, file operations based on user input and insecure use of unserialize().
Runtime code fetching, obfuscated code and settings that unauthenticated users can change may also increase a release’s risk score. Developers whose releases are blocked are expected to fix the reported problems and publish a new version. WordPress says that is generally faster than waiting for a manual appeal.
What website owners still need to do
The safeguard stops risky releases leaving WordPress.org, but it cannot force every site to install a safe update. A recent vulnerability in All-in-One WP Migration and Backup showed the scale of the problem: weeks after a fix was issued, most installations reportedly had not upgraded.
The review also does not cover premium plugins distributed independently, such as Elementor Pro. That makes site-level protection especially important. A WordPress care plan can help by checking for updates, testing changes, keeping recoverable backups and monitoring for vulnerabilities before a small issue becomes a major outage.
For site owners, WordPress’s new gate is welcome protection. It should be treated as one layer in a wider maintenance routine, not as a guarantee that every website is secure.