WordPress has announced a critical enhancement to its security posture, launching an automated security review for every plugin release. This initiative will analyze plugins for potential security issues before they are distributed through the **WordPress.org** update API, aiming to mitigate risks proactively. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," stated **David Perez**, **WordPress Official Plugin Repository Team Co-Lead**. "A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release." **WordPress** highlighted that the absence of a consistent review step between committing a release and its distribution to users created a vulnerability window for malicious attacks. ### Catching Threats Before Distribution The content management system (CMS) platform recently demonstrated the system's effectiveness. On July 28, 2026, the automated review detected a backdoor committed to a plugin release with approximately 20,000 active installations. Due to the release being within a cooldown window, the compromised version never reached the **WordPress.org** update API. The plugin was subsequently closed for downloads 26 minutes after the Plugins Team was alerted by **Wordfence**, a **WordPress** security company. The name of the affected plugin was not disclosed. This new system builds upon the **Protect The Shire** security initiative, launched on June 5, 2026, which introduced a cooldown period for all **WordPress** plugins and themes before auto-updates are distributed. This cooldown, currently set at six hours (down from an initial 24 hours), provides a buffer against immediate malicious updates. ### How the Automated Review Works This latest effort aims to automate the blocking of high-risk plugin or theme releases, eliminating the need for manual intervention from the Plugins Team. The process unfolds as follows: * During the cooldown period, changes in each release are analyzed by artificial intelligence (AI) models and **Jetpack Scan** within **WordPress.org**. * Results are cross-verified and combined to generate a security score, with a higher score indicating a potentially higher risk. * Releases exceeding a defined high-risk threshold are automatically blocked, while those below it proceed normally. * Plugin committers receive an email detailing findings only if a plugin is blocked. It's important to note that a high-risk score does not exclusively signify malicious intent; it also flags inadvertently introduced security flaws. ### Developer Guidelines for Enhanced Security **Perez** elaborated that the security review targets the same vulnerability classes as any standard security audit. He urged developers to adhere to **WordPress Coding Standards** and **PHP_CodeSniffer (PHPCS)** rules to ensure code quality and validation. Developers of **WooCommerce** extensions are also advised to utilize the **Quality Insights Toolkit (QIT)** testing platform. Patterns that can elevate a plugin's risk score include: * **REST**, **AJAX**, or admin-post endpoints lacking a capability check (a nonce alone is insufficient for authorization). * Queries constructed without `$wpdb->prepare()`. * File paths, uploads, deletions, or includes built from request data. * `unserialize()` operations on request data or remote responses. * Options, user meta, or settings written from endpoints accessible by subscribers or unauthenticated users. * Code fetched or evaluated at runtime, and obfuscated or packed code. If a release is blocked, developers must review the findings, address the issues, and publish a new release. Should the subsequent release score below the high-risk threshold, it will proceed through the normal cooldown process. "If a finding looks incorrect, authors can contact the Plugins Team," **Perez** added. "Please understand that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual review of an appeal."