WordPress Update Delay Leaves Sites Vulnerable to Exploitation

WordPress.org's "Protect The Shire" initiative, aimed at bolstering the security of its vast plugin and theme ecosystem, has introduced a significant delay before updates become available to users. Initially a 24-hour hold, this period has since been reduced to approximately six hours. However, analysis reveals that this delay applies equally to routine updates and critical security patches, potentially leaving millions of WordPress sites exposed to known vulnerabilities for extended periods.

The initiative, rolled out on June 5th, 2026, was designed to mitigate risks such as malicious code injection or backdoors being introduced into plugins and themes, especially in scenarios involving the sale of plugins or the use of AI-generated code. A key misunderstanding and practical issue identified by researchers is that the "Protect The Shire" delay affects both automatic updates and the manual update button within the WordPress dashboard, contrary to initial announcements suggesting it only impacted auto-updates.

During a six-week observation period under the original 24-hour window, researchers tracked 114 plugin and theme releases. They found that the time from a version being tagged by a developer to it becoming downloadable was nearly instantaneous. The actual delay occurred in the final step: when the update-check API began serving the new version to WordPress dashboards. The median delay observed was 24.4 hours, with no instances of developers being slow to ship updates; the bottleneck was consistently WordPress.org's own system.

Crucially, security fixes for disclosed vulnerabilities were not prioritized. Analysis of releases showed that both routine feature updates and patches for known CVEs experienced nearly identical delays. Over a 17-day period, 81 releases patching disclosed CVEs were subject to this delay, impacting 79 distinct plugins with a combined install base of approximately 9.9 million sites. Among these, 30 fixes were rated CVSS 7.0 or higher, with nine rated 9.0 or higher, including a critical arbitrary file deletion vulnerability.

Specific examples highlight the practical implications. The AcyMailing plugin, which released version 10.11.1 to fix an unauthenticated SQL injection, had its update-check API stuck on the vulnerable 10.11.0 version for an extended period. Similarly, the Page View Count plugin's update-check API lagged behind its publicly available metadata, leaving sites vulnerable to a lower-privilege settings-change bug. Another case involved the contact-form-7-mailchimp-extension, which was delayed in delivering a fix for a stored XSS vulnerability (CVE-2026-15000).

The core problem lies in the timing mismatch between vulnerability disclosure, patch availability, and the speed of exploitation. While the median time to mass exploitation for heavily exploited vulnerabilities is often cited as around five hours, the "Protect The Shire" delay, even at six hours, creates a window where attackers can exploit known issues before users are even notified of a fix. Attackers monitoring changelogs can identify newly patched vulnerabilities and target sites that are unaware of the available update, as their dashboards still report the software as up-to-date.

While the reduction from 24 hours to six hours is an improvement, it does not eliminate the risk. The delay means that even users diligently checking their dashboards might miss critical security updates, as the update-check API lags behind the actual availability of the patched code. This situation underscores a critical tension between the desire for ecosystem security and the immediate need for rapid patching in the face of fast-moving threats.