Dockside Press
Last week, we were very pleased to see that WordPress.org has added security reviews to plugins. This news is extremely positive and is one of the more recent stories that is very positive and encouraging for the WordPress community.
These reviews use a mix of AI platforms to evaluate the code. As Mr. David Perez states:
During the cooldown, the changes in each release are analyzed in WordPress.org by several AI models together with Jetpack Scan. The results are cross-checked and combined into findings with a security score. The higher the score, the higher the potential risk. Cross-checking multiple tools keeps accuracy high and false positives low, but not zero.
Releases with a high risk score are blocked automatically as soon as the security review finishes, and all plugin committers receive an email with the findings. Releases below that threshold continue through the normal process.
The inclusion of this security review means less chances of exploits or CVE’s coming through plugins and impacting thousands of sites without their knowledge.
If you’re a plugin developer, Mr. Perez also goes over what kind of tools you can use to make sure you’re commits are valid before sending them to WordPress’ SVN.
