WordPress.org will now automatically block a plugin update from reaching your site if it looks malicious, before it ever appears in your dashboard.
What happened
The WordPress Plugins Team announced an automated security review that runs on every plugin and theme release. Since June 5, every release has sat in a 6-hour cooldown before it goes out through the WordPress.org update API. During that window, the system now runs the code through multiple AI models and Jetpack Scan, cross-checks the results, and assigns a security score. A release that scores above the risk threshold gets blocked automatically, and the plugin’s committers get an email with the specific findings.
The team built this after a real incident. On July 28, a backdoor was committed to a release of a plugin with around 20,000 active installations. The automated review flagged it with a high-risk score while the release was still in its cooldown window, so the compromised version never reached the update API or any site. Wordfence separately reported the update to the Plugins Team, which closed the plugin for downloads 26 minutes later. That gap between detection and a person acting on it is what pushed the team to make blocking automatic instead of relying on someone being available to step in.
The Plugins Team says a high score doesn’t mean a developer acted with bad intent. If your update gets blocked, the process is to read the findings, fix the flagged code, and publish a corrected release, which the team says is faster than appealing the decision.
What this means for your site
You don’t need to do anything. This runs entirely on WordPress.org’s side, before an update ever reaches your site’s update screen. It’s a second line of defense on top of your own instinct to review changelogs and be cautious about which plugins you install, and it comes about a week after WordPress.org detailed its broader Core Security Initiative to keep pace with a surge in AI-assisted vulnerability research.
End of article