WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

Cybersecuritynews •Guru Baran • September 10, 2026

WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WordPress Implements AI Security Review to Prevent Malicious Plugin Updates WordPress has introduced an automated security review system for plugin releases to enhance security before updates reach users. This decision follows an incident on July 28, where a backdoor was found in a plugin update affecting around 20,000 installations. The automated review assigns a security score to each release during a six-hour cooldown period, blocking those deemed high-risk. The system utilizes multiple AI models and Jetpack Scan to analyze changes and reduce false positives. If a release is blocked, authors are notified via email and must address the issues before resubmitting. The new process aims to prevent similar incidents in the future by ensuring that potentially harmful updates do not reach millions of sites. The automated review is part of ongoing efforts to refine security measures in the WordPress ecosystem. 4 sources 45

Extracted Entities

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

The full story

Extracted Entities

Attack Types (1)

Domains (1)

MITRE ATT&CK (1)