We’re launching an automated security review for every plugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. release. Before a release is distributed through the WordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ update API An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., it is analyzed for security issues and releases that are considered to pose a potential security risk (either intentional or unintentional).
This post explains how the process works and what is expected from plugin authors when a release is blocked.
Why we’re doing this
New plugins are reviewed before they enter the directory, but updates ship continuously after that. A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release. Until now there was no consistent review step between a release being committed and that release reaching millions of sites.
On July 28, a backdoor was committed to a release of a plugin with around 20,000 active installations. The automated review detected it and assigned a high security score, and because the release was still inside the cooldown window, the compromised version was never distributed through the WordPress.org update API. The plugin was closed for downloads 26 minutes after the Plugins Team was notified by Wordfence about the update.
That incident also made clear the missing piece: a high-risk result should stop distribution automatically, without depending on someone from the Plugins Team being available. That’s what we’re launching now.
How it works
Since June 5, every plugin and theme release goes through a cooldown before it is distributed through the WordPress.org update API, including one-click updates from the WordPress dashboard. The cooldown period is currently at 6 hours.
During the cooldown, the changes in each release are analyzed in WordPress.org by several AI models together with Jetpack Scan. The results are cross-checked and combined into findings with a security score. The higher the score, the higher the potential risk. Cross-checking multiple tools keeps accuracy high and false positives low, but not zero.
Releases with a high risk score are blocked automatically as soon as the security review finishes, and all plugin committers receive an email with the findings. Releases below that threshold continue through the normal process.
A high score does not mean malicious intent. An accidentally introduced vulnerability can score just as high as intentional malware. The score measures risk, not intent.
Right now, emails are only sent when a release is blocked. Authors who haven’t received an email don’t need to take any action.
When a release is blocked
A high risk score means the release will not be distributed through the update API until the issues are resolved.
The fastest way to get a release unblocked:
- Review the reported findings. They describe what triggered the block Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience..
- Fix the issues and publish a new release. When the new release scores below the blocking threshold, it continues through the normal cooldown process.
- If a finding looks incorrect, authors can contact the Plugins Team.
Please understand that the team handles a high volume of reviews, so publishing a fixed release is almost always faster than waiting for a manual review of an appeal.
Feedback
This process will keep evolving as we collect more data and improve the checks. Feedback about false positives is the most useful thing plugin authors can give us to make the system better.
Post written by @davidperez, reviewed by @frantorres, @lucasbustamante, @obenland.
