WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," David Perez, WordPress Official Plugin

Report facts: WordPress is introducing an automated security review system for every plugin release before it is distributed via the WordPress.org update API, aiming to detect potential security issues and block high-risk updates prior to reaching users. This shifts plugin vetting from a one-time pre-directory review to continuous, automated checks on each update. RealGround analysis: While not an AI feature itself, this reflects a broader AI supply chain pattern where automated scanners and review pipelines will increasingly gate software and AI components before distribution, making the integrity and configuration of those pipelines a security concern. Organizations using WordPress or similar ecosystems should treat these automated review services and their outputs as part of their software and AI supply chain, aligning them with SBOM practices and readiness assessments to ensure they are correctly trusted, monitored, and complemented by independent security testing.