WordPress Auto-Blocks High-Risk Plugin Updates With New AI Security Review

WordPress has rolled out an automated security review system that scans every plugin release before it reaches users through the WordPress.org update API. The new process uses AI models alongside Jetpack Scan during the platform's existing cooldown window—currently set at six hours, down from 24 when the "Protect The Shire" initiative launched on June 5, 2026—to generate a composite risk score. Releases exceeding a high-risk threshold are blocked from distribution automatically, without requiring manual intervention from the Plugins Team.

The move addresses a long-standing gap in the WordPress ecosystem: while new plugins are vetted before entering the directory, updates have historically shipped continuously without a consistent review step. According to David Perez, WordPress Official Plugin Repository Team Co-Lead, "a plugin can be secure today and introduce a vulnerability, or malicious code, in a future release." The need for automated oversight became clear on July 28, 2026, when WordPress detected a backdoor committed to a release of a plugin with approximately 20,000 active installations. The compromised version was blocked during its cooldown period and never reached end users, with downloads closed 26 minutes after Wordfence alerted the Plugins Team. WordPress has not disclosed the name of the affected plugin.

When a release is flagged, the system emails findings to the plugin's committers—though notifications are only sent in cases where distribution is blocked. The review evaluates the same vulnerability classes a manual security audit would, including injection flaws, cross-site scripting, and unauthorized code execution paths. A high score does not necessarily indicate malicious intent; inadvertently introduced flaws can trigger a block just as easily as intentional malware. Perez urged developers to follow WordPress Coding Standards and validate their code using PHP_CodeSniffer (PHPCS) rules before submitting releases.

For website owners concerned about the integrity of their WordPress installations, the change represents a meaningful hardening of the plugin supply chain. Still, administrators should audit their own environments for lingering risks—running a privacy checkup to verify exposed services, using a port scanner to confirm no unexpected services are listening, and checking their domains through a WHOIS lookup to ensure registration details haven't been tampered with.