WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress implemented an automated, AI-driven security review and mandatory six-hour cooldown for every plugin/theme release after a malicious backdoor commit was pushed to a plugin with ~20,000 active installs; the AI review flagged the update with a high security score and the update was not distributed. The change embeds multiple AI models alongside Jetpack Scan to compute a security score and automatically block high-risk releases, notifying committers and encouraging fixes or appeals to the Plugins Team to reduce supply-chain exposure.