Automated Security Review Initiative Unveiled by WordPress
WordPress has announced a groundbreaking initiative to implement an automated security audit for each plugin prior to its distribution via the WordPress.org update API.
This proactive measure aims to scrutinize plugins for potential vulnerabilities, thereby safeguarding users from undue risks.
“New plugins undergo scrutiny before they are added to the directory; however, subsequent updates are released continuously,” noted David Perez, Co-Lead of the WordPress Official Plugin Repository Team. “A plugin may be secure today, yet introduce a vulnerability or malicious code in future iterations.”
The platform highlighted the absence of a “uniform review phase” between the commit of a release and its rollout to users, which could pave the way for malevolent intrusions.
Remarkably, the automated review mechanisms identified a backdoor that had been integrated into a plugin release boasting approximately 20,000 active installations on July 28, 2026.
Fortunately, owing to a cooldown window, the compromised version never reached distribution through the WordPress.org update API.
The plugin was swiftly pulled from downloads a mere 26 minutes after the Plugins Team received an alert about the update from WordPress security firm Wordfence. The name of the compromised plugin has not been publicly disclosed.
Effective June 5, 2026, every WordPress plugin and theme is subject to a cooldown period prior to auto-update distribution as part of the newly launched security initiative dubbed Protect The Shire.
This newly introduced delay is designed to create a buffer that prevents malicious revisions from reaching end users immediately. The cooldown period has been optimized to six hours, down from an initial 24 hours.
The Security Review Process
This latest measure aspires to address an additional significant security void: a plugin or theme release that obtains a high-risk score will automatically halt distribution, circumventing the necessity for Plugins Team intervention. The operational process unfolds as follows:
- During the cooldown period, alterations in each release are meticulously examined on WordPress.org through artificial intelligence (AI) models in conjunction with Jetpack Scan.
- The outcomes are cross-checked and amalgamated into a security score, with a higher score indicating a potentially elevated risk.
- Releases assigned a high-risk score are automatically blocked upon the completion of the review, while those falling below the threshold proceed through the regular distribution pathway.
- Plugin developers are consequently notified via email regarding the findings, but notifications are only dispatched when a plugin is obstructed.
It is crucial to note that a high-risk score does not inherently imply malicious intent. The score also accounts for inadvertently introduced security weaknesses alongside intentional malware.
Perez elaborated further, indicating that the security review “searches for the same classes of vulnerabilities as any security audit” and urged developers to adhere to WordPress Coding Standards and the rules established by PHP_CodeSniffer (PHPCS) to ascertain their code’s integrity and quality.
Furthermore, developers creating WooCommerce extensions are encouraged to utilize the Quality Insights Toolkit (QIT) testing platform.
Factors Elevating Risk Scores
Additional aspects that could potentially escalate the risk score encompass the following:
- REST, AJAX, or admin-post endpoints lacking a capability check (wherein a nonce alone does not suffice for authorization).
- SQL queries constructed without $wpdb->prepare().
- File paths, uploads, deletions, or inclusions derived from request data.
- Utilization of unserialize() on request data or external responses.
- Options, user meta, or settings modified through endpoints accessible by subscribers or unauthorized users.
- Runtime-evaluated code and code that is obfuscated or packed.
Once a release is obstructed, the only recourse for the developer to lift the restrictions involves reviewing the findings, rectifying the identified issues, and publishing a new iteration.
Should the new release yield a score below the high-risk threshold, it will then undergo the standard cooldown procedure.
“If any findings seem erroneous, authors are encouraged to reach out to the Plugins Team,” remarked Perez.
“However, it is vital to acknowledge that the team manages a substantial volume of reviews, making the publication of a rectified release generally quicker than awaiting a manual review of an appeal.”
Source link: Thehackernews.com.
