A quieter week for new plugin flaws, but two stories worth your attention. WordPress.org tightened its defenses against malicious plugin updates, and Automattic, the company behind WordPress.com, Jetpack, and WooCommerce, had a leadership shake-up at the top.
Security: A New Backstop for Bad Plugin Updates
WordPress.org will now automatically block a plugin update from reaching your site if it looks malicious, before it ever shows up in your dashboard. Every release already sat in a 6-hour cooldown before going live. Now, during that window, multiple AI models and Jetpack Scan analyze the code, cross-check their findings, and assign a risk score. A release that scores too high gets blocked at the source, and the plugin’s developer gets an email explaining why.
The team built this after a real incident in July, when a backdoor was committed to a plugin with around 20,000 active installs. The automated review caught it while the release was still in its cooldown window, so the compromised version never reached a single site. You don’t need to do anything to benefit from this. It runs entirely on WordPress.org’s side, as a second line of defense on top of keeping automatic updates on and choosing plugins carefully.
Accessibility: Admin Icons Are Getting an SVG Overhaul
The icons in your admin bar and sidebar menu are due for a rebuild. A patch in progress would replace Dashicons, the icon font WordPress has used in wp-admin for years, with SVG icons instead. Font-based icons cause real accessibility problems: screen readers often announce them inconsistently or not at all, and Windows High Contrast Mode can make them vanish entirely.
Nothing changes on your site yet. The patch is still under review, but it’s worth watching if you or your team rely on screen readers or high-contrast settings to manage your site.
Business: Automattic’s Board Puts Mullenweg on Leave
Automattic’s board placed founder and CEO Matt Mullenweg on paid leave this week and named CFO Mark Davies as interim CEO, TechCrunch reported on September 9. Automattic confirmed the move in a statement, saying the board has “full confidence” in Davies’ leadership. Mullenweg says he voted against the decision and, in an internal Slack message, accused three board members of coordinating the vote without giving him time to consult a lawyer. The board hasn’t publicly detailed its reasons.
It’s worth keeping two things separate here. Automattic is the commercial company behind WordPress.com, Jetpack, WooCommerce, and Tumblr, and this leadership change affects that company. Mullenweg reportedly remains on Automattic’s board and keeps his separate role leading the WordPress.org project, the open-source software and plugin directory your site actually runs on. Nothing about how WordPress.org operates has changed. It’s not yet clear how long Mullenweg’s leave will last or whether he’ll return as CEO.
End of article