Word Press Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

Summary: WordPress introduced an automated security review for every plugin release before it is distributed through the WordPress.org update API, and on July 28, 2026 the review detected a backdoor in a release of a plugin with about 20,000 active installations. The release was still inside a cooldown window, so the compromised version was never distributed, and the plugin was closed for downloads 26 minutes after Wordfence alerted the Plugins Team.
Why it matters: A backdoor reached a release of a plugin installed on roughly 20,000 sites, and only the cooldown window - currently six hours, down from 24 - kept it from shipping through auto-updates. The new high-risk score also flags inadvertently introduced flaws, not just intentional malware, so a blocked release can mean a genuine vulnerability in code the developer believed was fine.

Read the original at The Hacker News ↗