WordPress has announced a new automated security review process for plugins. Every release of a plugin will now be scanned for potential security issues before it is made available through the WordPress.org update API. The goal is to catch high-risk updates early and prevent them from being distributed to the millions of sites that rely on the platform.
This move extends beyond the initial review of new plugins, which was already in place. By covering every subsequent update, WordPress aims to close a gap where malicious or vulnerable code could slip in after a plugin had been approved. The automated system is designed to analyze each release for common security problems and flag anything that looks dangerous.
Because this is a single announcement, there are no contrasting viewpoints to compare. The source does not specify how the review will handle false positives or whether developers can appeal a block, but the core change is clear: plugin updates will face a mandatory security gate before reaching users.