WordPress adds automated security checks to block risky plugin releases

WordPress adds automated security checks to block risky plugin releases WordPress’ automated security review will now assess every plugin release before it is distributed through the WordPress.org update API. Releases considered a potential security risk will be blocked automatically. “A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release. Until now there was no consistent review step between a release being committed and that release reaching millions of sites,” David Perez, Co-Lead, WordPress Official Plugin Repository Team, explained. What prompted the security review On July 28, the automated review detected a backdoor committed to a release of a plugin with around 20,000 active installations. The system assigned the release a high security score. The compromised version was still within the cooldown window and was never distributed through the WordPress.org update API. The Plugins Team closed the plugin for downloads 26 minutes after Wordfence notified the team about the update. The incident showed that a high-risk result should stop distribution automatically, without depending on the availability of a team member. How the review works A six-hour cooldown period for every plugin and theme release was introduced on June 5. During this period, releases are held before distribution through the WordPress.org update API, including one-click updates from the WordPress dashboard. Several AI models and Jetpack Scan analyze the changes in each release during the cooldown period. The results are cross-checked to improve accuracy and reduce false positives, then combined into findings with a security score. A higher score indicates a higher potential security risk. If a release is considered high risk, it is automatically blocked. Everyone with permission to commit to the plugin receives an email explaining the findings. Releases that are not considered high risk continue through the normal process. A high-risk score does not indicate intent. An accidental security issue can receive the same score as deliberately added malware. The score shows the level of security risk. Authors need to take action only if they receive an email stating that their release was blocked. No email means no action is required. What happens when a release is blocked When a plugin receives a high-risk score, the release will not be distributed until the issues are resolved. To have a release unblocked, authors should first review the reported findings to determine what triggered the block. They should then fix the issues and publish a new release. If the new release scores below the blocking threshold, it will proceed through the normal cooldown process. Authors who believe a finding is incorrect can contact the Plugins Team. The team handles a high volume of reviews, so publishing a fixed release is usually faster than waiting for a manual review of an appeal. Perez said the team will continue to refine the process as it collects more data and adjusts its checks. Feedback about false positives will help increase the system’s accuracy.