WordPress Adds Automated Security Checks to Block Risky Plugin Releases
Summary
WordPress now uses AI models and Jetpack Scan during a six-hour cooldown to review plugin releases and block those deemed high risk. The change followed detection of a backdoor in a plugin release before it reached the update API.
Key points
- Every plugin and theme release is held for a six-hour cooldown before distribution through the WordPress.org update API.
- AI models and Jetpack Scan analyze release changes, cross-check findings, and assign a security score.
- High-risk releases are automatically blocked; plugin committers receive an email explaining the findings.
- The system detected a backdoor in a release of a plugin with about 20,000 active installations; the release was blocked during the cooldown and was not distributed through the update API.
- Authors must address reported issues and publish a new release to resume distribution; they can contact the Plugins Team if they believe a finding is incorrect.
- A high-risk score indicates potential security risk, not intent, and may reflect an accidental issue or deliberately added malware.
Article Details
- Event Type
- WordPress introduced automated security reviews that assess plugin releases before distribution and automatically block releases considered high risk.
- Impact
- The review detected a backdoor in a plugin release associated with about 20,000 active installations. The release was blocked during the cooldown period and was never distributed through the WordPress.org update API. Plugin authors must address reported issues and publish a new release before distribution can proceed.