WordPress Now Auto-Scans Every Plugin Update for Security Risks

Somewhere between you clicking “Update” and that update actually landing on your store, WordPress.org has quietly added a new checkpoint. Since June 2026, every plugin and theme release headed for the official update system gets scanned by AI models plus Jetpack Scan before it’s allowed out the door. If something looks risky enough, the update gets blocked automatically, before it ever reaches your site.

This is good news, and worth five minutes to understand, because it changes what “this plugin is on WordPress.org” actually means for your store’s security going forward, and it also has a real limit worth knowing about.

What’s Actually Happening Behind the Scenes

According to the official WordPress.org announcement, every plugin and theme release now goes through a review window before it’s distributed through the update system your site checks against. Multiple AI models scan the code change, and the results get combined into a single risk score. High score, the release gets held back automatically. No human has to catch it first.

The team gave a concrete example: on July 28, this system caught a plugin update that had a backdoor built into it, on a plugin with roughly 20,000 active installs. It never reached the update system. The listing was shut down within 26 minutes of the team being alerted.

A “Blocked” Update Isn’t Always a Scandal

Worth knowing before you see this mentioned somewhere and panic: the WordPress team is explicit that a high risk score doesn’t automatically mean someone shipped malware on purpose. Their own words: an accidentally introduced vulnerability, an unsanitized field, a missing permission check, a plain bug, can score just as high as intentional malicious code. So if you ever see a developer mention their update got flagged, it’s more often “we found a bug and fixed it fast” than “we got caught doing something shady.”

What This Changes for Your Store

• Free plugins from the WordPress.org repository now get an automatic security pass on every single update, not just when they’re first submitted. That’s a real upgrade in baseline safety for anything you installed through your dashboard’s Add Plugin screen.
• This doesn’t require you to do anything. There’s no setting to turn on, no plugin to install. It happens on WordPress.org’s end before the update ever reaches your site.
• It’s not a reason to stop updating promptly. The scan catches risky code before distribution; it doesn’t retroactively fix a vulnerability sitting in a version you’re already running. Keep applying updates the moment they’re available, the same advice as always.

The Part That Doesn’t Cover Your Premium Plugins

Here’s the honest limit: this scan sits on the path between a developer’s release and WordPress.org’s own update system. If a plugin is premium and updates itself through its own licensing system rather than through wordpress.org, most of your paid extensions, your page builder’s premium add-ons, your payment gateway extensions, your theme’s pro version, its updates simply don’t pass through this particular checkpoint. That’s not a knock on premium software specifically; it just means this one automated gate is scoped to the free-plugin update pipeline.

The practical takeaway: for your free.org-hosted plugins, you now get this scan for free with zero effort on your part. For anything premium, it’s worth knowing whether the vendor runs its own security review process before shipping updates, especially for anything touching checkout, customer accounts, or payments, since that’s where a vulnerability does the most damage to a store.

A Quick Checklist for Store Owners

• List your active plugins and note which are free (.org, now covered by this scan) versus premium (vendor’s own update pipeline, not automatically covered).
• For premium plugins handling checkout, accounts, or payments specifically, it’s reasonable to ask the vendor what their release/security review process looks like. A vendor with nothing to say here is worth a second look.
• Keep applying updates promptly regardless. This scan reduces new risk going forward; it doesn’t patch anything already installed.
• Don’t drop a plugin just because you saw “blocked release” mentioned somewhere. Check whether it was fixed quickly, that’s the signal that matters, not the fact that a scan flagged something once.

This post is based entirely on the official WordPress.org announcement on the Make WordPress Plugins blog, published September 9, 2026.

Interesting Reads

10 Best WordPress Plugins for Website Speed
How to Access WordPress Admin with a Fatal Error Warning