WordPress update delay leaves security fixes six hours late

A WordPress update delay that began as a 24-hour hold on plugin and theme releases has been cut to about six hours, but security fixes still wait in the same queue as routine changes, according to measurements published by Patchstack. WordPress.org introduced the policy, called Protect The Shire, on June 5, 2026. It applies to roughly 78,000 plugins and themes in the WordPress.org directory. Under the policy, every new release waits before being served through the update mechanism, and the wait affects both automatic updates and the manual Update Now button because both are gated by the same clock.

Patchstack did not rely on WordPress.org's own account of the hold. Instead, the company measured it directly. Daily median gate times held steady at roughly 24.2 to 24.5 hours from July 7 through July 15, then dropped sharply to roughly 6.6 to 6.8 hours starting July 16. That was a single-day change with no gradual ramp, visible across hundreds of releases a day. The security reasoning behind the hold is straightforward: plugins have been sold to new owners who quietly plant backdoors, and AI-assisted development makes it easier to slip bad code into a release unnoticed. A pause before a release reaches every site is a sensible response to that supply-chain risk.

Protect The Shire appears to help against supply-chain attacks. On July 28, Wordfence caught a planted backdoor in the Advanced Responsive Video Embedder plugin, which has about 20,000 installs. The malicious code was detected two hours after it landed and was assigned CVE-2026-18072 with a CVSS severity score of 9.8, allowing full administrator takeover through a single request. WordPress.org pulled the plugin the same day, and it was not yet broadly distributed through auto-update. Patchstack cannot prove the hold caused the save, but the timing is consistent with the policy doing its job. Still, Patchstack notes that this is one documented case, not a pattern, and the blast radius it reduced is small compared with the exposure the same policy currently creates.

The problem is that malicious releases and disclosed vulnerabilities are different threats, yet Protect The Shire treats them identically. Patchstack tracked 114 resolved releases and found that plugin and theme updates were held back by a median of 24.4 hours. The company specifically checked whether disclosed security fixes received faster clearance than routine releases. They did not. Confirmed security releases and ordinary updates both waited about 24.4 hours before July 16, and about 6.8 hours after. Over a 17-day window, 81 releases patching a disclosed CVE moved through this delay, 49 under the old 24-hour window and 32 under the shorter one. These releases covered 79 distinct plugins with a combined install base of roughly 9.9 million. Thirty of the fixes were rated CVSS 7.0 or higher, nine were rated 9.0 or higher, and one was a perfect 10.0 for arbitrary file deletion. Patchstack is careful to say that combined install base describes install counts across those plugins, not confirmed vulnerable sites, and a manual reinstall can bypass the delay entirely.

Two concrete examples show what this looks like in practice. AcyMailing's plugin page and its plugin information API both showed version 10.11.1, the fix for an unauthenticated SQL injection, while the update-check API still served version 10.11.0, the vulnerable version. The Page View Count plugin did the same: its page showed version 2.9.2, but the update-check remained on 2.9.1, the version with a lower-privilege settings-change bug. A third case, contact-form-7-mailchimp-extension, tracked as CVE-2026-15000 for stored cross-site scripting, was gated for 24.5 hours. Patchstack found no evidence of active exploitation during these gate windows, but noted an important inverse: the one vulnerability they did see under active exploitation during this period was a WordPress core issue whose fix was already auto-updatable, so the delay did not catch it.

The speed gap is stark. Patchstack points out that the median time to mass exploitation for heavily exploited vulnerabilities is five hours. For a critical WordPress core vulnerability Patchstack disclosed in July, real exploitation attempts started 90 minutes after the patched version was released, and three hours after the fix was committed. Core updates are not gated the way plugin updates are, but the lesson transfers: once a fix is public, attackers need minutes rather than hours. The problem expands for agencies and hosts managing WordPress at scale. Their tools sit on the same update mechanism that WordPress.org has gated. If the layer underneath is blind to a fix for six hours, the tool built to move faster is blind too. For a hosting company, that means a six-hour blind spot on every customer account running the affected plugin, not just one site.

Patchstack recommends exempting confirmed vulnerability fixes from the hold or fast-tracking them through the same review process. Right now WordPress.org does not distinguish between security fixes and routine updates. Site owners should not assume that update tooling closes the gap, because many tools rely on the same API that is currently the bottleneck. Patchstack also notes that manually reinstalling a plugin or downloading the zip directly skips the wait. For website owners and IT teams, using a managed WordPress host that handles updates and security maintenance outside the normal update-check queue can reduce this risk. AEU Hosting, AEU Group's managed WordPress platform, is built to keep WordPress installations updated and monitored, so owners spend less time manually checking for delayed plugin updates. Patchstack is now offering hosting partners free protection for 30 days at cost, so vulnerabilities get covered when detected rather than when the update check catches up. A head start should not belong to the attacker. For six weeks it was a full day, and now it is six hours, which is still longer than attackers typically need to begin exploiting a public fix.