WordPress has introduced an automated security review system for plugins to assess potential vulnerabilities prior to distribution through its update API. This initiative aims to ensure plugins are free from security risks before being made available to users.
Enhancing Plugin Security
David Perez, co-lead of the WordPress Official Plugin Repository Team, emphasized the importance of this development. While new plugins undergo initial scrutiny, updates are frequently released without a corresponding review process, potentially introducing vulnerabilities or malicious code.
The absence of consistent post-commit reviews has been a concern, as it could leave room for security breaches. Recently, the automated system detected a backdoor in a plugin with 20,000 active installations before its distribution, thanks to the cooldown period introduced in the Protect The Shire initiative.
Protect The Shire Initiative
Since June 2026, WordPress has implemented a cooldown phase for plugins and themes, aimed at preventing immediate distribution of potentially harmful updates. Initially set at 24 hours, this period is now six hours, allowing time for thorough security checks.
The latest security measure automatically halts distribution of any plugin or theme with a high-risk security score, minimizing the need for intervention by the Plugins Team. The review process involves AI models and Jetpack Scan, which analyze changes and calculate a security score.
Addressing Security Vulnerabilities
Developers are notified via email if a plugin is blocked due to a high-risk score. Perez clarified that the scoring system flags both intentional and inadvertent security issues. Developers are encouraged to adhere to WordPress Coding Standards and utilize tools like PHP_CodeSniffer and Quality Insights Toolkit for code validation.
Some factors contributing to a high-risk score include insecure endpoints, unprepared database queries, and unsafely handled request data. Developers must address these issues and release an updated version to lift any restrictions.
In conclusion, the introduction of automated security reviews by WordPress significantly enhances plugin safety. By preventing the distribution of high-risk updates, this initiative protects users and encourages developers to maintain high coding standards.
