WordPress has introduced an AI-driven security mechanism to scrutinize every plugin before it reaches the WordPress.org update API. This addition serves as a crucial checkpoint in their plugin distribution, addressing gaps that previously existed.
The Need for Enhanced Security
Recently, a significant security lapse was highlighted when a backdoor was inserted into a plugin update affecting around 20,000 active installations. This incident exposed vulnerabilities in the system from the point of committing a plugin update to its deployment on millions of websites.
On July 28, 2026, a malicious update was uploaded during WordPress.org’s mandatory cooldown window. Fortunately, the new AI review system identified this threat with a high security score, preventing its distribution through the update API.
Automated Blocking Mechanism
The WordPress Plugins Team swiftly removed the compromised plugin from the directory shortly after being notified by security firm Wordfence. This event underscored the inefficiency of relying solely on manual intervention, prompting the development of an automated blocking system.
Since June 5, 2026, every plugin and theme has undergone a six-hour cooldown period before becoming available. During this time, AI models, alongside Jetpack Scan, analyze code changes, consolidating their findings into a comprehensive security score.
System Implementation and Developer Guidance
Plugin releases that exceed a certain risk threshold are automatically blocked, with developers receiving detailed email notifications. However, a high score doesn’t necessarily indicate malicious intent; it could also result from coding errors or vulnerabilities.
WordPress.org advises developers to address flagged issues promptly, as resolving these concerns and releasing a revised version is the quickest way to proceed through the distribution process.
For those suspecting a false positive, contacting the Plugins Team is an option, though submitting a corrected release is typically faster due to the volume of submissions.
Future Outlook
With WordPress powering a substantial portion of the internet, the security of its plugins is paramount. This AI-driven approach shifts the focus towards a proactive defense model, similar to strategies adopted across other software distribution platforms.
The Plugins Team is committed to refining the detection thresholds and models based on feedback and data collection, encouraging developers to report false positives to enhance the system’s accuracy.
This automated security enhancement marks a significant milestone in WordPress’s infrastructure, ensuring that plugin updates are securely managed across millions of sites worldwide.
