Because whoever can commit to a plugin can ship code to every site that updates it. In June 2024, WordPress.org reported that five committer accounts were compromised by credential reuse and used to issue malicious updates to five plugins. Your sites inherit the security habits of each plugin author, which you cannot see directly.
What the Plugins Team reported
The Plugins Team post from 26 June 2024 states that on 23 and 24 June, five WordPress.org user accounts were compromised by an attacker trying username and password combinations previously exposed in breaches elsewhere. The attacker used those accounts to issue malicious updates to five plugins, and the team then issued security updates to protect users.
The post lists roles on a plugin: an owner, who can close or transfer it and issue updates; committers, who can issue new versions through SVN; and support reps, who manage support only. It advises keeping committers to the minimum, never sharing accounts, and never using a shared mailbox such as a support address, since anyone with access to that mailbox could reset the password.
Controls WordPress.org has added since
- Two factor authentication has been required for plugin owner and committer accounts since 1 October 2024, according to the Plugins Team.
- SVN passwords separate commit access from the main account password.
- Release Confirmations, opt-in, email committers a link to confirm a release before it is issued, and a second confirmer can be required on request.
- Since 2026, a release cooldown and automated review, covered in our post on that change.
What you can and cannot control
| You can | You cannot |
|---|---|
| Keep an inventory of every plugin and version | Enforce an author's password habits |
| Prefer plugins with active, named maintainers | Audit a vendor's internal access |
| Hold updates briefly on high-impact sites | Guarantee a release is clean |
| Monitor for plugins closed or removed | Prevent every compromise |
Questions to ask about a plugin you depend on
- Who maintains it, and is there more than one person?
- Does the readme or vendor site mention release confirmations or two factor use? Many will not say, which is itself a data point.
- How quickly have past security reports been fixed?
- Is there a path to leave if the author disappears? See what to do when a plugin author stops responding.
Apply it to your own team
Agencies publish plugins too. If you maintain a plugin, apply the same advice to your accounts: individual logins, a unique long password, two factor on, a short committer list, and release confirmations switched on.
What to tell clients
Clients sometimes ask whether plugin vendors can be trusted. A fair answer is that you cannot verify each vendor's internal controls, but you can reduce exposure: fewer plugins, plugins with visible maintainers, tested updates, backups and a routine for noticing closures. Say what you monitor and how quickly you act. That is more honest than a promise that nothing can go wrong, and it matches how the incident reports describe the problem.
Quick check
Does two factor on WordPress.org mean updates are always safe?
No. It raises the cost of account takeover but does not review code or stop an intentional bad release.
Can I see who commits to a plugin?
Not fully from the public page. Maintainers and contributors are visible, but commit rights are managed by the owner.
Sources
- Keeping Your Plugin Committer Accounts Secure
- Upcoming Security Changes for Plugin and Theme Authors
- Plugin Check and 2FA Now Mandatory For New Plugin Submissions
Last reviewed: 19 October 2026.
