WordPress Will Now Scan Every Plugin Update for Malicious Code

Key points

• WordPress is rolling out automated security reviews for every plugin update before it reaches the websites that run on the platform.
• The checks will run on submissions to the WordPress.org update system, catching risky code before it ships to site owners.
• Until now, new plugins were vetted on entry but subsequent updates went out without a fresh security review.
• David Perez of the WordPress Official Plugin team confirmed the change in a post on the WordPress developer blog.
• The move follows a run of supply-chain attacks in which criminals hijacked plugin developer accounts and pushed poisoned updates to live websites.

WordPress is closing a gap that attackers have exploited for years.

Starting now, every update a plugin developer submits to WordPress.org will be run through an automated security review before the platform pushes it out to websites. The change was announced by David Perez of the WordPress Official Plugin team, and first reported by The Hacker News.

"New plugins are reviewed before they enter the directory, but updates ship continuously after that," Perez wrote. That single sentence describes the hole. A plugin could pass a careful human review on day one, then quietly turn hostile months later when its developer pushed a tainted update.

Why does this matter to ordinary website owners?

Because plugins are how most WordPress sites get broken into. Plugins are small add-on programs that give a site extra features: a contact form, a shop, a booking calendar. WordPress powers a large share of the web, so a single bad plugin update can hit hundreds of thousands of sites in hours.

That's not hypothetical. Over the past two years, attackers have repeatedly stolen the login credentials of plugin developers, published malicious updates under the developer's name, and watched as the WordPress auto-update system distributed the malware for them. We covered two textbook cases of exactly this within weeks of each other: the BdThemes hijack on 10 August, which spawned hidden admin accounts across affected sites, and the earlier ShapedPlugin supply-chain hit in June, where attackers slipped a backdoor into licensed Pro releases. Site owners did nothing wrong. They kept their software up to date, which is normally the right advice.

What will the automated review actually do?

It'll scan each update's code for known signs of malicious behaviour before that update enters the WordPress.org update feed. WordPress hasn't published the full detection ruleset, which is sensible: publishing it would tell attackers exactly what to hide.

The review is automated, not human. That is the point. WordPress.org hosts tens of thousands of plugins and processes a constant stream of updates. No human team could read every diff. An automated pipeline can, and it can do it in seconds.

What it won't catch

Automated scanners catch patterns they've been taught to look for. A careful attacker who writes novel code, or hides behaviour behind a remote command server, can still slip through. Security researchers have been picking apart WordPress supply-chain attacks for years, and the sophisticated ones look nothing like textbook malware.

This is a real improvement, not a cure. It raises the cost of easy attacks, worth doing. It doesn't end the category.

What should site owners do?

Keep updating your plugins. Turn on auto-updates if you haven't already. Remove plugins you no longer use, because every installed plugin is another developer account that could be hijacked. If you run a shop or handle customer data, ask whoever maintains your site whether they monitor for unexpected file changes.

My read: this should've been the default a decade ago. The interesting question is whether WordPress publishes numbers on how many bad updates the new system blocks in its first six months. If it does, expect the figure to be uncomfortable, and expect it to be the strongest argument for the change.