WordPress Introduces Automated Security Reviews for Plugin Updates

On September 14, 2026, WordPress announced the launch of an automated security review system for all plugin updates distributed via the WordPress.org update API. According to David Perez, a WordPress official, the new process will analyze each plugin release for potential security issues before it is made available to the public. This initiative closes a critical gap: while new plugins undergo manual review before entering the directory, updates have historically been shipped without the same level of scrutiny. The automated review is intended to block high-risk updates from reaching the millions of WordPress sites that rely on the plugin ecosystem. The announcement did not specify the exact technical mechanisms or the criteria used to flag risky updates, but it represents a significant step in platform-level security. No active exploitation has been reported in connection with this change; it is a proactive measure to strengthen the supply chain. WordPress site owners and developers are expected to benefit from an additional layer of protection, though the effectiveness of the automated review will depend on its implementation and ongoing refinement.