WordPress Now Blocks High-Risk Plugin Updates Automatically

WordPress has started using automated security reviews to harden WordPress plugin security, checking every plugin release before it is distributed to websites through the official update API, the service that delivers new plugin versions to WordPress sites. The announcement comes from the WordPress plugin repository team. New plugins are already reviewed before they enter the directory, but once a plugin is listed, its updates ship continuously after that point. David Perez, co-lead of the WordPress Official Plugin Repository Team, explained that a plugin can be secure today and introduce a vulnerability or malicious code in a future release. Without a consistent review step between the moment a release is committed and the moment it reaches downstream users, the platform said, attackers could slip harmful code into an update.

The new automated check has already caught real trouble. WordPress said its review detected a backdoor committed to a release of a plugin with about 20,000 active installations on July 28, 2026. Because that release was still inside a cooldown window, the compromised version never got distributed through the WordPress.org update API. The plugin was closed for downloads 26 minutes after the Plugins Team was alerted to the update by the WordPress security company Wordfence. WordPress did not name the plugin. A backdoor is a hidden method that lets an attacker enter a site or server even after the plugin is installed.

Since June 5, 2026, every WordPress plugin and theme goes through a cooldown period before it can be distributed through automatic updates as part of an initiative called Protect The Shire. The cooldown currently lasts six hours, down from 24 hours when it was first introduced. This waiting time adds friction so that malicious updates cannot reach site owners immediately. The latest review system closes a further gap: when a plugin or theme release gets a high-risk score, distribution should stop automatically without anyone from the Plugins Team needing to intervene.

During the cooldown, WordPress.org analyzes the changes in each release using artificial intelligence models together with Jetpack Scan, a security scanning service. The results are cross-verified and combined into a single security score, and a higher score means a potentially higher risk. Releases with a high-risk score are blocked automatically once the review completes, while releases below that threshold continue through the normal process. Plugin committers receive an email with the findings only when a plugin is blocked. WordPress also notes that a high-risk score does not necessarily mean malicious intent, because the score includes both intentionally planted malware and security flaws introduced by accident.

The review looks for the same vulnerability classes that any security audit would look for, according to Perez. Developers are urged to follow WordPress Coding Standards and PHP_CodeSniffer (PHPCS) rules to validate their code and keep its quality high. For WooCommerce extensions, the Quality Insights Toolkit (QIT) testing platform is recommended. Patterns that can raise the risk score include REST, AJAX or admin-post endpoints without a capability check, where a nonce alone is not accepted as authorization; database queries built without the $wpdb->prepare() function; file paths, uploads, deletions or includes built from request data; unserialize() calls on request data or remote responses; and options, user metadata or settings written from endpoints reachable by subscribers or unauthenticated users. Code that is fetched or evaluated at runtime, as well as code that is obfuscated or packed, can also raise the score. In plain terms, a capability check confirms that the current user has permission for an action, while a nonce is only a one-time token to prevent certain forged requests. The prepare function safely handles data before it is placed into a database query, and unserialize turns a stored value back into a structured object, which becomes dangerous when the input comes from an untrusted request or remote response. Obfuscated code is written to hide what it really does.

When a release is blocked, the developer can only remove the restriction by reviewing the findings, fixing the issues, and publishing a new release. If the new release scores below the high-risk threshold, it continues through the normal cooldown process. If a finding looks incorrect, authors can contact the Plugins Team, but Perez added that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual appeal.

For website owners, this change adds an extra review layer between a plugin author and your live site, but it does not replace routine update hygiene. Keep automatic updates enabled where possible, back up your site before applying major changes, and remove plugins you no longer use. Pairing those habits with a managed WordPress host that supports staging and review is another practical safeguard, and AEU Hosting provides that kind of controlled update workflow for WordPress sites.