WordPress.org holds each plugin and theme release in a cooldown, currently 6 hours, before it reaches the update API. During that time several AI models and a scanning tool analyze the changes. Releases with a high risk score are blocked automatically. It is a useful safety net for site owners, not a replacement for your own controls.
What the Plugins Team announced
On 9 September 2026 the team published a post titled Automated security review for plugin releases. It says new plugins are reviewed before entering the directory, but updates ship continuously afterward, so a plugin can be secure today and introduce a vulnerability or malicious code in a later release. Until now there was no consistent review step between a commit and the release reaching sites.
The post says that since 5 June, every plugin and theme release goes through a cooldown before distribution via the WordPress.org update API, including one-click updates from the dashboard. The cooldown is currently 6 hours.
How the review works
- Changes in each release are analyzed by several AI models together with a scanning product.
- Results are cross-checked and combined into findings with a security score.
- A high score blocks the release as soon as the review finishes, and all plugin committers get an email with the findings.
- A high score measures risk, not intent. An accidental vulnerability can score as high as deliberate malware.
The post describes one case: on 28 July a backdoor was committed to a release of a plugin with around 20,000 active installations. The review flagged it, and since the release was still inside the cooldown, the compromised version was never distributed through the update API. The plugin was closed for downloads 26 minutes after the team was notified.
What this means for agencies
| Question | Answer |
|---|---|
| Does it stop every bad release? | No. The post itself notes false positives and misses are possible |
| Does it cover premium plugins or private update servers? | It applies to releases distributed through the WordPress.org update API |
| Does it replace staging tests? | No |
| Does it change auto-update risk? | It narrows one window, since new releases wait before distribution |
Steps to take
- Keep auto-updates under a policy, not a hunch. Our auto-update decision guide covers the tradeoffs.
- Keep an inventory so you can still answer which sites run an affected plugin.
- Watch for plugins that disappear from the directory. See what happens when a plugin is closed for security.
- Keep your own checks on files, using the checksum commands covered in other posts.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a release that was clean at install time can be flagged later.
Quick check
Does the cooldown mean updates are delayed by 6 hours?
Per the announcement, yes, releases wait out a cooldown that is currently 6 hours before distribution.
If a release is blocked, what happens?
It is not distributed until the author fixes the findings and publishes a new release that scores below the threshold.
Sources
Last reviewed: 19 October 2026.
