WordPress Automates Plugin Security Reviews with AI to Block Risky Releases
WordPress.org has implemented an automated security review system using AI to scan all new plugin releases, automatically blocking those identified as potential risks before they reach users.
WordPress has significantly enhanced its plugin security by introducing an automated review process that scans every new plugin release before it is distributed through the official WordPress.org update API. This proactive measure aims to automatically block any release flagged as a potential security risk, a crucial step given the vast number of WordPress sites worldwide.
David Perez, Co-Lead of the WordPress Official Plugin Repository Team, highlighted the previous gap in security oversight. "A plugin can be secure today and introduce a vulnerability, or malicious code, in a future release. Until now there was no consistent review step between a release being committed and that release reaching millions of sites," he stated. This new system addresses that critical vulnerability in the release pipeline.
The impetus for this change was a real-world incident on July 28, when the automated review system detected a backdoor embedded in a plugin with approximately 20,000 active installations. The system assigned this release a high security score, and it was successfully blocked from distribution through the WordPress.org update API before it could affect any user sites. The compromised version was caught within its six-hour cooldown window, preventing widespread compromise.
This incident underscored the need for an automated system that can halt distribution without relying on the immediate availability of a human team member. The new process, which began with a six-hour cooldown period for all plugin and theme releases on June 5, allows multiple AI models and Jetpack Scan to analyze code changes. These analyses are cross-referenced to ensure accuracy and minimize false positives, culminating in a security score that dictates the release's fate.
Releases scoring high risk are automatically blocked, and the plugin author receives an email detailing the findings. If a release is not deemed high risk, it proceeds through the normal distribution channels. It's important to note that a high-risk score does not imply malicious intent; accidental security flaws can also trigger a block. The score solely reflects the potential security risk.
Authors whose releases are blocked must first review the reported findings to understand the cause. They then need to fix the identified issues and publish a new release. If this subsequent release scores below the blocking threshold, it will undergo the standard cooldown process. While authors can appeal findings, publishing a corrected release is generally a faster path to unblocking.
The WordPress team plans to continuously refine this automated review process. As more data is collected and the checks are adjusted, the system's accuracy is expected to improve. Feedback from authors, particularly regarding false positives, will be instrumental in this ongoing optimization effort.
This move represents a significant investment by WordPress in securing its massive ecosystem. By leveraging AI and automated checks, the platform aims to preemptively neutralize threats, protect millions of websites from vulnerabilities and malicious code, and foster greater trust in the plugins available through its official repository.