Helpnetsecurity WordPress Implements AI Security Review to Prevent Malicious Plugin Updates
Article Content
- •WordPress now uses AI to review plugin updates for security risks.
- •A backdoor incident on July 28 prompted the introduction of this automated review.
- •Plugins with high-risk scores are automatically blocked from distribution.
WordPress has introduced an automated security review system for plugin releases to enhance security before updates reach users. This decision follows an incident on July 28, where a backdoor was found in a plugin update affecting around 20,000 installations. The automated review assigns a security score to each release during a six-hour cooldown period, blocking those deemed high-risk. The system utilizes multiple AI models and Jetpack Scan to analyze changes and reduce false positives. If a release is blocked, authors are notified via email and must address the issues before resubmitting. The new process aims to prevent similar incidents in the future by ensuring that potentially harmful updates do not reach millions of sites. The automated review is part of ongoing efforts to refine security measures in the WordPress ecosystem.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track CVE-2026-20079 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…