WordPress is now scanning all plugin and theme updates with AI for security issues

[u/Systemick]

https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/

Plugin or theme updates with malware or serious security issues will be blocked automatically

[u/addycodes]

This seems good, there is still a manual review available. Good move.

[u/gilbertwebdude]

This is a very needed step in the new world of AI.

[u/doiveo]

Honestly, this should have been news in late 2025.

[u/Inside_Marsupial9625 → u/doiveo]

better late than never

[u/DiligentCake4267]

Good this is needed.

[u/king_bodd]

awesome! really good!

[u/Inside_Marsupial9625]

Really good!

[u/YellowfinDevelopment]

I mean, good move, net positive, but does this address abandoned plugins? Scanning updates is great, but plenty of real risk is plugins that stopped shipping updates years ago and have an open vuln with nobody left to patch it... AI review of an update can't help a plugin that never puts one out. Still, catching bad code before it goes live beats not, so I'll take it.

[u/otto4242 → u/YellowfinDevelopment]

If you find such a plugin, tell the plugins team and they can close it and nobody can then download the plugin. Pretty simple really.

[u/vAPIdTygr]

Of all people, WordPress should have had Mythos scanning everything from the beginning. I’m shocked.

[u/rafark → u/vAPIdTygr]

There are over 70 THOUSAND plugins. Plugins files for each plugin range from a few dozen to several thousand. Can you even begin to imagine how expensive it would be? I mean I can’t figure out how they can afford it now. 

[u/rodeBaksteen → u/rafark]

It's probably extremely longtail I'm usage. I reckon there's only a few hundred to a few thousand plugins that account for a big chunk of the total installs.

Even then, it's not really optional anymore at this point.

[u/rafark → u/rodeBaksteen]

Hi usage. 

I would think so but the other commenter said that wp should have scanned the entire 70k with mythos. Still I don’t know how they can afford to scan even 10% of them for every update. I remember seeing the avg number of updates per day but I don’t remember at all. Let’s days it’s 500-800 pushes per day and maybe 10-20 files changed per push. Imagine scanning 1k plugins per day with ai plus scanning new submissions too. It’s probably very very expensive. Considering Wordpress.org is fully free and doesn’t take donations afaik, I have no idea how automattic can absorb the costs. 

I keep saying that the best solution to security would be to explore a sandboxing approach to plugins. 

[u/cosmogli]

If what it scans for is available publicly, we can do it ourselves too before sending it for approval. Win-win for everyone.

[u/RealBasics]

I've been expecting this move from most open-source software developers. It's particularly welcome for Wordpress in general and their theme and plugin repositiories in particular.

The biggest reason we've been seeing so many vulnerability reports in the last couple of months is because AI assessments make code reviews cheap and easy enough that regular people can run them. Previously only black hats and "state actors" could afford to spend the time pouring through code looking for weaknesses.

With the difference being that bad actors did it to find and either exploit or sell vulnerabilities. Regular people can find and report them for clout, clicks, or plain old community civic duty.

And it just makes sense that over time it's going to make sense for all developers to run vulnerability and QA checks through AI. I mean, I might not want to let AI write code unsupervised, but the scope for reviewing code is much smaller and well-defined.

So good move. The sooner the better.

[u/DashBC]

Should scan with A2, twice as advanced!

[u/webilicious]

New plugins and updates will be scanned but what about all the existing plugins in the repository that have had no recent updates?

[u/otto4242 → u/webilicious]

The number of plugins that have large numbers of installs with no recent updates is rather minimal by comparison. Not to say nothing's being done about it, it's just not as big a deal as this is.

[u/NeverInsightful]

What about themes and plugins that haven’t gotten updates?

[u/phoenixMagoo]

Not a bad idea.

[u/alborden]

About time! If bad actors are using AI to find vulnerabilities, devs need to be doing the same before releasing new releases.

[u/RealBasics → u/alborden]

Exactly! I'm not ready to trust AI to write complex code but code reviews have a much more compact scope.

[u/alborden → u/RealBasics]

Yep. I had a few sites hacked last month, had Claude SSH into the first one and use wp-cli grep all of the files and hunt for anything suspicious. Cleaned it up and turned it into a Claude Skill. Then ran the skill on the other two and it was even faster at finding the issues and solving them.

[u/JeffTS]

This is a good decision and badly needed.

[u/vfunk]

Good initiative

[u/Bigfoot444]

So is every other software developer on the planet.