Security firm Patchstack has published an analysis arguing that WordPress.org’s “Protect the Shire” policy, introduced to stop backdoored plugins from reaching sites, is holding up genuine security fixes for just as long as routine, cosmetic ones.

What Protect the Shire does

WordPress.org added a review hold on new plugin and theme releases so an automated scanner can check for malicious code before an update reaches your site. It worked: last week, Wordfence’s AI tool caught a backdoored plugin with 20,000 installs before it reached a single site, widely seen as the policy’s first real win.

What Patchstack found

Patchstack tracked 114 plugin and theme releases and measured the gap between when a developer tagged a new version and when WordPress.org actually started serving it to sites through the update-check API. Before July 16, that median wait was about 24 hours. After July 16, it dropped to about 6.8 hours, a one-day step change that applied equally to every release, whether it fixed a critical flaw or just changed a button color.

Of the releases studied, 81 patched a publicly disclosed vulnerability across 79 plugins with a combined 9.9 million installs. Thirty of those fixes addressed a flaw rated 7.0 or higher on the CVSS severity scale, and nine were rated 9.0 or above, including one rated the maximum 10.0. Patchstack says it found no evidence any of these were actively exploited during the delay window, so this is a risk finding, not a report of real-world break-ins.

Patchstack also flagged two specific cases where the patched version was already visible on the plugin’s public page while the update-check API was still serving the older, vulnerable one: AcyMailing, whose 10.11.1 update fixed an unauthenticated SQL injection flaw, and Page View Count, both stuck showing the previous version through the dashboard.

What WordPress.org says

Plugin authors who need to ship an urgent security fix can already email the Plugins Team to have the hold lifted, and WordPress.org displays that option on the plugin’s own page once a new version is pending. The Plugins Team says it is working toward making that fast-track automatic, using its AI reviewer to clear safe-looking updates without a manual request.

What to do

If you’re waiting on a fix for a plugin with a publicly known vulnerability and it isn’t showing as available yet, check the plugin’s official page on WordPress.org directly rather than assuming your site is protected once the fix is publicly announced. The dashboard update notice can lag behind the developer’s own changelog by several hours.

End of article