Security1 publisher2 min readPublished
Automated scoring now decides whether a WordPress plugin release reaches the update API
The WordPress.org update API will refuse any plugin release its own scoring calls high risk. The decision moves off a team member's inbox and onto a threshold the announcement does not publish.
The Watch · Security desk
What happened
- WordPress.org now assesses every plugin release before it is distributed through its update API, and any release scored as a potential security risk is blocked automatically rather than reviewed later.
- A six-hour cooldown introduced on June 5 holds each plugin and theme release before distribution, including the one-click updates that WordPress dashboards pull.
- On July 28 the review scored a backdoor committed to a release of a plugin with around 20,000 active installations as high risk, and that version never left the cooldown window.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability A stolen commit credential now has to produce a diff that reads clean to a cross-checked panel of scanners, instead of hiding on live sites after the release has already gone out.
- exposure Sites on one-click auto-update inherit WordPress.org's scoring threshold as their only pre-install gate, so how that threshold is tuned decides what lands on them.
- constraint An author with an urgent fix that trips the scorer cannot argue their way past it quickly; the practical route back is another release, which costs a build cycle.
- precedent WordPress changed its default from human takedown to automatic refusal on the strength of one case where the detection worked and staffing was the variable.
Six hours is 360 minutes. The 26 minutes between Wordfence notifying the Plugins Team and the team closing that plugin for downloads spent about seven percent of the hold [13]. The margin existed only because the cooldown had been running since June 5, 53 days before the July 28 catch [14]. The detection came from the review system, while the stop depended on an outside notification and a team member acting on it [3] [4]. That split is the reasoning WordPress gives for letting a high-risk score halt distribution on its own [8].
The score carries no judgement about intent. An accidental flaw can land on the same number as deliberately planted malware [10]. So the gate that catches a backdoor also catches a botched sanitisation fix, and both authors get the same email and the same remedy: read the findings, fix, publish again, and clear the threshold on the next release [7] [9]. Appeals exist, but according to the Plugins Team, shipping a corrected release is usually faster than waiting for a manual review, because the review volume is high [12]. Authors who get no email do nothing [11].
David Perez, co-lead of the WordPress Official Plugin Repository Team, said before this change there was no consistent review step between a release being committed and that release reaching millions of sites [2]. What replaces that gap is a panel: several AI models plus Jetpack Scan read the diff during the hold, their outputs are cross-checked against each other to cut false positives, and the findings collapse into one score [6]. The account does not state the blocking threshold, name the models, or give a false-positive rate [15]. Perez said the checks will be refined as more data arrives and that false-positive reports will feed accuracy [16], which is a fair description of a system whose one published performance datum is the July 28 catch [3].
The broader reading, that other package registries will now be measured against this, is not in the evidence. The announcement covers WordPress.org's own update API and names no other registry [18]. What it does establish is a distribution channel that fails closed on a scanner verdict, for plugins and for the one-click updates that pull them [1] [5].
What to watch
- Whether theme releases get the same scoring and automatic block, or only the six-hour hold.
- The first documented backdoor that scores below the threshold and ships through the update API.
- A published count of blocked releases, which would show whether the gate is mostly catching malware or ordinary bugs.