WordPress Introduces Automated Security Review for Plugins
In a significant advancement for online security, WordPress has unveiled plans to implement an automated security review for every plugin prior to its distribution via the WordPress.org update API.
This initiative is designed to scrutinize plugins for potential security vulnerabilities, thereby mitigating associated risks.
David Perez, Co-Lead of the WordPress Official Plugin Repository Team, articulated the necessity of this measure: While new plugins undergo review before entering the directory, updates are released continuously thereafter.
A plugin may be secure today but could harbor vulnerabilities or malevolent code in future updates, he stated.
The platform acknowledged that the absence of a “consistent review step” between the committing of a release and its downstream distribution could inadvertently facilitate malicious exploits.
In a revealing case, WordPress reported that its automated system detected a backdoor in a plugin update which boasted approximately 20,000 active installations on July 28, 2026.
Remarkably, the compromised version did not reach users due to its occurrence within a cooldown window.
The plugin was retracted from downloads just 26 minutes after the Plugins Team was notified of the update by Wordfence, a security firm specializing in WordPress. However, the identity of the plugin remains undisclosed.
Since June 5, 2026, every WordPress plugin and theme has been subjected to a cooldown period prior to being disseminated through auto-updates under a new security initiative dubbed Protect The Shire.
This protocol aims to introduce a certain level of delay to ensure malicious updates do not reach end-users instantaneously.
Currently, the cooldown period is set at six hours, a reduction from the initial 24-hour timeframe established at its inception.
The latest measure strives to rectify another significant security loophole: any plugin or theme release deemed high-risk will be automatically precluded from distribution, bypassing the need for intervention from the Plugins Team. The outlined process comprises the following steps:
- During the cooldown period, a comprehensive analysis of each release is conducted within WordPress.org using artificial intelligence (AI) models in conjunction with Jetpack Scan.
- Results from this analysis are collated and assigned a security score: a higher score indicates a potentially greater risk.
- Releases that receive a high-risk score are automatically blocked upon review, whereas those below the threshold proceed through the standard process.
- Developers of the affected plugins receive an email detailing the findings, although these notifications are only dispatched when a plugin is blocked.
It is essential to note, however, that a high-risk score does not automatically imply malicious intent; it may also account for inadvertently introduced security vulnerabilities alongside deliberate malware.
In further remarks, Perez clarified that the security review “is aimed at identifying the same classes of vulnerabilities typically scrutinized in a security audit,” encouraging developers to adhere to WordPress Coding Standards and the rules established by PHP_CodeSniffer (PHPCS) to verify their code quality.
Developers creating WooCommerce extensions are urged to utilize the Quality Insights Toolkit (QIT) testing platform.
Several patterns that could potentially elevate the risk score are outlined below:
- REST, AJAX, or admin-post endpoints lacking capability checks (a nonce is insufficient for authorization)
- Queries constructed without $wpdb->prepare()
- File paths, uploads, deletions, or inclusions derived from request data
- Employing unserialize() on request data or on data retrieved from remote responses
- Endpoints that write options, user meta, or settings accessible to subscribers or unauthenticated users
- Code retrieved or executed during runtime, and obfuscated or compressed code
Once a release is blocked, the sole recourse for the developer to lift the restrictions involves addressing the identified issues and submitting a new release.
If the new iteration scores below the high-risk threshold, it will undergo the standard cooldown process.
“Should any finding seem inaccurate, authors are encouraged to reach out to the Plugins Team,” Perez emphasized.
“Please keep in mind that the team manages a substantial volume of reviews; hence, publishing a rectified release is typically more expedient than awaiting a manual review of an appeal.”
Source link: Thehackernews.com.
