What changed
The WordPress.org Plugins Team has launched an automated security gate for every plugin release. Since June 5, plugin and theme releases have passed through a cooldown before distribution through the WordPress.org update API; the cooldown is currently six hours. During that window, WordPress.org analyzes release changes using several AI models together with Jetpack Scan, cross-checks the results and produces a security score. The new enforcement step automatically blocks releases with a high-risk score from the update API and emails all plugin committers with the findings. The release stays blocked until a corrected version scores below the threshold or the Plugins Team resolves a false positive.
Why it matters
WordPress plugin supply-chain risk often appears after a plugin has already passed its initial directory review. Until this system, there was no consistent security-review gate between a maintainer committing an update and that update reaching potentially millions of sites through one-click updates. Automatic blocking changes that distribution boundary. The Plugins Team says the underlying review already caught a July 28 backdoor in a plugin with around 20,000 active installations; because the compromised version was still inside the cooldown, it never reached users through the update API. That gives the new gate more operational weight than a policy-only announcement.
Every release now has a security window before distribution
WordPress.org says every plugin and theme release has gone through a cooldown since June 5, currently set to six hours. Plugin ZIPs can be committed during that period, but the release is held back from the update API, including the one-click update path in WordPress dashboards.
Multiple scanners feed one blocking decision
During the cooldown, WordPress.org runs several AI models plus Jetpack Scan against the changes. Findings are cross-checked and combined into a security score. The Plugins Team says this reduces false positives but does not eliminate them, and a high score reflects risk rather than proof of malicious intent.
High-risk results now stop distribution automatically
The new enforcement layer blocks a high-risk release as soon as the review finishes instead of depending on a human reviewer being available. Committers receive the findings by email. A fixed release goes through the cooldown again, while authors can contact the Plugins Team if they believe the block is incorrect.
A real backdoor was already caught before it reached users
WordPress.org says a backdoor was committed on July 28 to a plugin with about 20,000 active installations. The automated review gave the release a high security score while it was still in cooldown, so the compromised version was never distributed through the update API. Wordfence separately notified the Plugins Team, and the plugin was closed for downloads 26 minutes later.
The trade-off is slower release propagation and possible false positives
The security benefit comes with a deliberate delay: routine releases wait through the cooldown, and legitimate code can still trigger a high score. Plugin authors therefore need to account for the review window in urgent release planning and keep an eye on committer email when an update does not propagate as expected.