Are there procedures to prevent malicious plugin updates?

This is a random thought I’ve had today. Here’s the scenario:

I’ve got a plugin on the WordPress store with 100+ active installs. I recently updated the plugin and pushed the changes to the WordPress SVN. Around 60% of users updated the plugin in the first couple of days – but what’s not to say that I could have updated my own plugin with malicious code? For example, my plugin lets users create a phone number shortcode – but in the update, I could have changed the code to check if a plugin such as WooCommerce was installed and forward on their customer data to an external location. Are there procedures in place to prevent such things?

It worried me slightly because I have many plugins written by other developers on my website and I update them without checking what changes have been made all the time!

TLDR: No. It’s all about trust.

So there are some very basic checks on wp.org but generally this can happen (and probably also does happen from time to time). Of course if something like this happens and people notice it wp.org can block updates or replace them with something safe.

Also have a look at the WordPress.org Theme and Plugin Repositories section.

What you can do is not really any different than what you’d do whenever you install software, things like:

• look at the source code
• research on the plugin and/or the developer to decide if they deserve your trust
• talk to other people about the plugin
• do not randomly install plugins you come along
• hire someone to do audits
• …