WordPress now automatically blocks plugin releases that Jetpack Scan and AI models flag as risky during a six-hour review window. No human review, no appeal. A July 2026 backdoor affecting 20,000 installations sparked the change.
The system solves a real problem: stopping malware before distribution. But it trades one risk for another. If AI misses something nasty, nobody catches it. If a plugin gets flagged without clear feedback, developers can’t debug in six hours.
WordPress is betting everything on automation. Whether developers adopt the system or route around it will show if the gamble pays off.
Sources: Automated Security Review for Plugin Releases
Coverage: WordPress Adds Automated Plugin Reviews
Related on this blog: A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade • [AUTO] CSS Breaks Email Sandboxes • [AUTO] MLflow SSRF: validating before connecting