WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress has announced a significant enhancement to its plugin security process: a new automated security review system. This initiative, named ‘Protect The Shire,’ will analyze every plugin release before it’s made available through the WordPress.org update API, effectively preventing vulnerable plugins from reaching users. The system leverages artificial intelligence (AI) models and Jetpack Scan to assess the risk associated with each release.

Previously, plugins could be secure at the time of release but introduce vulnerabilities in subsequent updates. The new system addresses this by introducing a cooldown period – currently 6 hours, previously 24 – between a plugin’s commit and its distribution. During this cooldown, changes are analyzed to determine a security score, with releases exceeding a high-risk threshold automatically blocked.

In a recent example, a backdoor was detected in a plugin with approximately 20,000 active installations, but the release was within a cooldown window, preventing its distribution. The system flags various potential vulnerabilities, including missing capability checks in REST, AJAX, or admin-post endpoints, insecure queries, and the use of `unserialize()` on request data. Developers publishing WooCommerce extensions are encouraged to use the Quality Insights Toolkit (QIT) testing platform.

Plugin committers receive an email detailing any findings, and the team encourages developers to address issues and publish a new release to remove restrictions. If a finding is disputed, developers can contact the Plugins Team for review. The system is designed to handle a high volume of reviews, making it faster to publish a corrected release than to wait for a manual review.