WordPress Introduces Automated Plugin Reviews to Block High-Risk Updates

WordPress has announced it’s launching an automated security review for every release of a plugin before it’s distributed through the WordPress.org update API. The goal is to analyze each release for potential security issues and ensure there are no risks involved before the update reaches users.

Why the Change Is Needed

According to David Perez, WordPress Official Plugin, the current process leaves a gap after a plugin’s initial acceptance:

“New plugins are reviewed before they enter the directory, but updates ship continuously after that,” Perez said.

This means that while new plugins undergo review before entering the directory, subsequent updates have historically shipped continuously without the same level of scrutiny. The new automated review process is designed to close that gap by examining every release before it is distributed through the WordPress.org update API.