WordPress puts an automated security score between a plugin commit and the update API

WordPress said the gap it is closing sits between the commit of a release and its delivery to downstream users, where no consistent review step existed ^[17]. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," said David Perez, co-lead of the WordPress official plugin repository team ^[2]. "A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release." ^[3]

What drives the score up is a list of authorization and injection failures: REST, AJAX or admin-post endpoints without a capability check, where a nonce alone is not authorization; queries built without $wpdb->prepare(); file paths, uploads, deletions or includes built from request data; unserialize() on request data or on a remote response; options, user meta or settings written from endpoints reachable by subscribers or unauthenticated users; and code fetched or evaluated at runtime, including obfuscated or packed code ^[14]. Only the last item targets planted malware, and the rest of the list is ordinary audit output. Perez said the review "looks for the same vulnerability classes any security audit looks for", and pointed developers at the WordPress Coding Standards and PHPCS, with the Quality Insights Toolkit for WooCommerce extensions ^[12][13].

The account of the July 28 catch pulls in two directions. WordPress credits its automated review with detecting the backdoor in a release of the plugin, which had about 20,000 active installations ^[4]. The same account times the response from a third party: the plugin was closed for downloads 26 minutes after the security firm Wordfence alerted the Plugins Team ^[5]. WordPress did not disclose the plugin's name ^[5].

Twenty-six minutes is about 7 percent of a six-hour cooldown ^[1]. The window was 24 hours when Protect The Shire started on June 5, 2026, and it is 6 hours now, so 18 hours have come off ^[6][7][3]. The announcement does not say when that cut took effect, or which window was in force when the commit landed 53 days into the program ^[2]. The takedown fit inside either one.

The operational change is that a high score halts distribution once the review completes, with nobody from the Plugins Team in the loop ^[9]. Releases scoring below the threshold continue through the normal process ^[9]. An attacker holding committer credentials who keeps a payload under the threshold still ships on schedule after the cooldown.

Emails go out only when a release is blocked ^[10]. WordPress says a high score does not by itself indicate malicious intent, because the same number counts flaws introduced by accident alongside deliberate malware ^[11]. "If a finding looks incorrect, authors can contact the Plugins Team," Perez said. "Please understand that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual review of an appeal." ^[16]