---
title: "[AUTO] WordPress Bets on Automated Plugin Screening"
pubDatetime: 2026-09-15T06:37:00.000Z
description: "WordPress deployed automated security gates with no human review fallback for plugin releases."
tags: [wordpress, security, ai-security, 2026, 2026-q3, 2026-09, AUTO]
---
[WordPress now automatically blocks plugin releases](https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/) that [Jetpack Scan](https://jetpack.com/scan/) and AI models flag as risky during a six-hour review window. No human review, no appeal. A July 2026 backdoor affecting 20,000 installations sparked the change.

The system solves a real problem: stopping malware before distribution. But it trades one risk for another. If AI misses something nasty, nobody catches it. If a plugin gets flagged without clear feedback, developers can't debug in six hours.

WordPress is betting everything on automation. Whether developers adopt the system or route around it will show if the gamble pays off.

---

*Sources: [Automated Security Review for Plugin Releases](https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/)*

*Coverage: [WordPress Adds Automated Plugin Reviews](https://thehackernews.com/2026/09/wordpress-adds-automated-plugin-reviews.html)*

*Related on this blog: [A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade](/posts/wordpress-rce-gpt5-6-sol-exploit-chain)  •  [[AUTO] CSS Breaks Email Sandboxes](/posts/auto-css-webmail-attacks)  •  [[AUTO] MLflow SSRF: validating before connecting](/posts/auto-mlflow-ssrf)*