WordPress is launching an automated security check for every new plugin release before it is distributed through the WordPress.org API. High-risk updates will be blocked automatically, preventing millions of sites from installing problematic code by clicking "Update."
Previously, the WordPress team reviewed new plugins only at the initial submission stage. Subsequent versions were released without mandatory security screening, allowing a previously safe plugin to later introduce vulnerabilities, backdoors, or changes in ownership with malicious intent.
Under the Protect The Shire initiative, every release now faces a mandatory six-hour delay. During this period, multiple AI models together with Jetpack Scan analyze the code changes. Their findings are combined into a final risk rating.
If the rating is high, the update is excluded from automatic installation. Developers receive an email detailing the detected issues. The mechanism already demonstrated its value before full deployment: on 28 July it identified a backdoor in an unnamed plugin with approximately 20,000 active installations. The release was still in the waiting period and never reached sites. Within 26 minutes of a Wordfence notification, the plugin was closed for downloads.
A high risk score does not automatically imply malicious intent. The system treats both deliberately inserted malware and accidental dangerous errors with equal seriousness. Developers are invited to review the findings, fix the code, and release a new version. If the new version passes the threshold, it proceeds to distribution. Results can be appealed, but WordPress notes that correcting the release is typically faster than awaiting manual review.
