Key Takeaways
- WordPress.org now holds every plugin release for six hours while several AI models and Jetpack Scan analyze it, and anything rated high risk is blocked automatically.
- A July 28 backdoor was committed to a plugin with roughly 20,000 active installs and caught during the cooldown, but the release still had to be manually closed after Wordfence alerted the Plugins Team.
- The review stops bad code leaving WordPress.org, but it can’t patch the millions of installs that never update, and paid plugins like Elementor Pro skip the gate entirely.
On July 28, someone added a backdoor to a plugin for WordPress, which is used on roughly 20,000 sites. None of it was ever distributed through the update API.
In an announcement on September 9, the Plugins Team at WordPress.org said every plugin release now goes through an automated security check before WordPress.org distributes it through the update API.
If the automated review finds it high risk, the release won’t be served out. No human needs to be on duty to make that happen. And that was the point of the announcement.
The 26-Minute Problem
Here’s what happened with that particular malicious release, as told by the Plugins Team’s own account. It was released during a cooldown period that the WordPress.org team put in place on June 5. An automated check of the release found it high risk. But the plugin wasn’t closed for downloads until 26 minutes after Wordfence alerted the team about the release.
Twenty-six minutes isn’t long. But it depended on someone on the Plugins Team being available to pull it. In his post on September 9, David Perez, co-leader of the team that maintains the plugin repository, said the incident “made clear the missing piece: a high-risk result should stop distribution automatically, without depending on someone from the Plugins Team being available.”
And he pointed to a bigger problem. “A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release,” he said. “Until now there was no consistent review step between a release being committed and that release reaching millions of sites.”
New plugins entering the directory have always been checked before they go in. Updates just shipped. And in June, Matt Mullenweg described the repository as containing 78,000+ plugins and themes, with more than 400 million combined installs.
What’s Actually Checking the Code
Since June 5, every plugin and theme release has sat through a cooldown period before being made available. And the Plugins Team says that period is currently set at six hours.
During those six hours, each release is examined by a series of AI models the team uses in conjunction with Jetpack Scan. It combines the results of these tools into a security score for the plugin. If the score is high, it’s blocked and an email is sent to all committers on that plugin. Otherwise, it moves forward.
The team didn’t claim this process is foolproof. But by using more than one tool, they said, cross-checking “keeps accuracy high and false positives low, but not zero.” And importantly, Perez drew a distinction between risk and intent: “A high score does not mean malicious intent. An accidentally introduced vulnerability can score just as high as intentional malware. The score measures risk, not intent.”
When a plugin release is blocked, the process for the author is simple: look at the report, fix the code, and release again. If they disagree with a finding, they could write to the team. But, in the post, Perez said, “publishing a fixed release is almost always faster than waiting for a manual review of an appeal.”
The Summer That Made the Case
And what a time for the team to make this announcement. This summer, there were several CVEs in WordPress plugins.
One of those was a SQL injection flaw in the All-in-One WP Migration and Backup plugin (CVE-2026-19949), which runs on more than 5 million sites. In the wrong hands, it could allow unauthenticated remote code execution. ServMask fixed the problem on August 20. But as of September 3, only 35% of installs had upgraded, leaving roughly 3.2 million sites running a vulnerable version, according to SecurityWeek.
How WordPress.org built a gate in front of plugin updates
There was also a critical arbitrary file-upload flaw in Elementor Pro (CVE-2026-32475), which attackers were exploiting to upload web shells and perform commands into infected sites. And on the same day as the Plugins Team post, an authentication bypass in the Newfold plugins that come bundled with Bluehost, HostGator, Web.com, and Crazy Domains hosting accounts was disclosed.
Look at those three flaws. None of them was a malicious update. Rather, they were bugs in code that had already shipped. Perez says such a bug would score just as highly as intentional malware. So, in principle, a future version of any of those plugins might well be picked up by the review process. But that wouldn’t fix the existing versions already out there.
The Gate Only Works One Direction
This review keeps bad code from coming out of WordPress.org. But it doesn’t make anyone install the fix. Look at the numbers for the All-in-One plugin. For two weeks there was a patch, and 65% of its 5 million installations hadn’t taken it. No amount of scrutiny at the point of release changes that.
A critical patch distributed through WordPress.org’s update system can now face up to a six-hour delay, before it reaches sites that automatically update. The Plugins Team evidently thinks this is worth it. Probably it is, but it’s still a tradeoff.
Then there’s the premium plugin market: Because Elementor Pro is distributed outside of WordPress.org’s plugin directory, its releases aren’t subject to this WordPress.org review pipeline. Premium plugins are an important part of the WordPress software stack, and each vendor decides how thoroughly their plugins are reviewed.
For hosts, though, this change matters. Managed WordPress providers already monitor vulnerability advisories and have their own systems for dealing with vulnerable software. Starting this week, there’s a step in the .org repository that can catch a high-risk update before it reaches the auto-updater.
That’s a materially different floor than existed in May. Whether it holds depends on the accuracy of the review and on how many legitimate releases get put into the appeals process. And that’s what plugin developers will be complaining about and/or celebrating over the next few months.
In June, Mullenweg framed the whole effort with a line from Anne Lamott: “Bird by bird, buddy. Just take it bird by bird.” This bird took three months and a backdoor.
