WordPress Introduces AI-Driven Scan to Review Every Plugin Update

WordPress revealed today that a security filter powered by artificial intelligence will scrutinize each plugin update prior to its appearance on the official update API, adding an extra layer of protection for the millions of sites that depend on the open‑source CMS.

The solution relies on machine‑learning models trained to recognize malicious code signatures and activates automatically when developers upload new versions of their extensions. Should the AI spot dubious activity—such as concealed backdoors, obfuscated scripts, or illicit data exfiltration—the update is placed in quarantine and marked for human examination, stopping it from reaching end‑users.

This deployment comes after a high‑profile supply‑chain breach earlier this year in which a popular plugin was hijacked and used to deliver malware to thousands of WordPress sites. The incident exposed the lack of a pre‑distribution checkpoint in the update workflow, leaving owners exposed to code that seemed to originate from trusted sources.

For site administrators, the modification adds a protective shield without any required action; the WordPress.org update service will simply withhold compromised packages. Security experts have praised the approach, noting that automated screening can identify threats more quickly than manual reviews alone, while also warning that AI is not flawless and will need continual adjustment.

WordPress representatives said the AI filter will be constantly updated as new attack methods appear, and they plan to release transparency reports detailing how many updates are blocked or escalated. The effort marks a wider move toward proactive, automated security measures in the open‑source world and could set a benchmark for other platforms that distribute third‑party code.