A plugin update in the official WordPress repository no longer necessarily reaches users immediately. Every new release is analysed for security risks, and if the result indicates high risk, WordPress.org automatically stops its distribution.

What exactly has changed?

Until now, WordPress.org had been expanding automated scanning of updates, but the result still required action from the team. Now the missing part has been added: a release with a high risk score is blocked automatically before it starts being distributed through the WordPress update API.

That is an important distinction. The repository does not only tell an author: “there may be a problem in the code”. In certain cases it also says: “this version is not going any further for now”. Authors receive an email with the detected issues and can prepare a corrected release or report a false positive.

WebsiteGarage / Services

Explore our services.

Six hours for checks before the update reaches websites

Since June 5, 2026, new plugin and theme releases on WordPress.org have gone through a waiting period before distribution. It currently lasts six hours. During that time, code changes are analysed by several AI models and Jetpack Scan, and the results are compared and combined into a risk assessment.

If the result remains below the blocking threshold, the release continues through the normal process. If the threshold is exceeded, distribution is stopped. WordPress also stresses that a high score does not automatically mean malicious intent by the author. The same alert can be triggered by an ordinary but serious security bug.

It has already stopped a real backdoor

WordPress gives a specific example from July 28. A backdoor, meaning a deliberately left route for unauthorised access, was included in a release of a plugin used on around 20,000 sites. The automated scan marked the release as high risk, and because the version was still in the waiting period, it was not distributed through WordPress.org.

According to the Plugins Team, the plugin itself was closed for downloads 26 minutes after Wordfence reported the update. This case was one of the reasons the team decided that a high scan score should stop distribution automatically instead of waiting for a person.

AI did not get a “ban” button. It is part of a layered control system

It would be easy to describe this change as “AI decides which plugins are safe”, but that would be too simplistic. WordPress uses several models together with a traditional security scanner, the results are cross-checked, and the mechanism still allows false positives and a manual appeal by the author.

The more interesting part is something else: AI is no longer only a tool helping a reviewer or researcher. It is becoming part of the software distribution infrastructure. Code is assessed before an update appears in WordPress dashboards.

Does this mean updates from WordPress.org are now “checked and safe”?

Automated control reduces the chance that an obviously dangerous release will pass unnoticed, but it is not a security certificate. A scan can miss something, and a problem may only appear in a specific configuration or when combined with another plugin.

For website owners, the practical conclusion is positive, but boring in the best possible way: the official repository now has an extra barrier between an author’s code and the “Update” button in your WordPress installation. Backups and sensible update testing are still necessary.

WebsiteGarage’s take

This is one of those cases where AI makes sense precisely because it is not trying to pretend to be an all-knowing administrator. It gets a very specific job: review a huge number of changes, compare results from several tools and stop things that look genuinely bad before they go any further.

And that is much more interesting than another “write me a blog post” button. If automation is supposed to improve WordPress security, these are ideal places for it: repetitive, large-scale and time-consuming checks where a person can still step in when the situation is not clear.