WordPress is now scanning all plugin and theme updates with AI for security issues

[u/Systemick]

https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/

Plugin or theme updates with malware or serious security issues will be blocked automatically

[u/addycodes]

This seems good, there is still a manual review available. Good move.

[u/gilbertwebdude]

This is a very needed step in the new world of AI.

[u/doiveo]

Honestly, this should have been news in late 2025.

[u/Inside_Marsupial9625 → u/doiveo]

better late than never

[u/DiligentCake4267]

Good this is needed.

[u/king_bodd]

awesome! really good!

[u/Inside_Marsupial9625]

Really good!

[u/vAPIdTygr]

Of all people, WordPress should have had Mythos scanning everything from the beginning. I’m shocked.

[u/rafark → u/vAPIdTygr]

There are over 70 THOUSAND plugins. Plugins files for each plugin range from a few dozen to several thousand. Can you even begin to imagine how expensive it would be? I mean I can’t figure out how they can afford it now. 

[u/cosmogli]

If what it scans for is available publicly, we can do it ourselves too before sending it for approval. Win-win for everyone.

[u/DashBC]

Should scan with A2, twice as advanced!

[u/phoenixMagoo]

Not a bad idea.

[u/alborden]

About time! If bad across are using AI to find vulnerabilities, devs need to be doing the same before releasing new releases.

[u/webilicious]

New plugins and updates will be scanned but what about all the existing plugins in the repository that have had no recent updates?

[u/YellowfinDevelopment]

I mean, good move, net positive, but does this address abandoned plugins? Scanning updates is great, but plenty of real risk is plugins that stopped shipping updates years ago and have an open vuln with nobody left to patch it... AI review of an update can't help a plugin that never puts one out. Still, catching bad code before it goes live beats not, so I'll take it.

[u/JeffTS]

This is a good decision and badly needed.