Patchstack has published an analysis of WordPress.org’s Protect The Shire policy, and the practical message is awkward: the delay can help stop malicious plugin releases from reaching sites, but it may also slow down fixes for already disclosed vulnerabilities. For site owners, agencies, hosts, and WooCommerce stores with many plugins, this means the WordPress dashboard may not always be the fastest place to learn that a security fix exists.
Key Takeaways
- Protect The Shire delayed plugin and theme updates by about 24 hours, then about 6-7 hours after July 16.
- The delay affects both auto-updates and the manual Update Now button in WordPress admin.
- Patchstack found security fixes and routine releases waited almost the same amount of time.
- Patchstack tracked 81 CVE-fixing releases across 79 plugins with roughly 9.9 million combined installs.
- A WordPress dashboard may show no update while a fixed plugin version is already available elsewhere.
What Protect The Shire changes
According to Patchstack, WordPress.org announced Protect The Shire on June 5, 2026, as a way to lock down roughly 78,000 plugins and themes in the official directory. The first concrete measure is a hold before new plugin and theme releases are served through the normal update mechanism.
That matters because both automatic updates and the manual Update Now button use the same update-check system. So this is not just about background updates quietly waiting their turn. It can also affect the update you expected to click yourself.
The measured delay dropped, but did not disappear
Patchstack says it measured the delay directly. From July 7 to July 15, median gate times were roughly 24.2 to 24.5 hours. Starting July 16, that dropped sharply to about 6.6 to 6.8 hours.
Six hours is obviously better than a full day. But for public security fixes, it can still be a long time. Attackers do not politely wait for the admin dashboard to catch up before testing a known vulnerable plugin. Annoying, but that is the job description.
Where the policy appears to help
The strongest argument for Protect The Shire is supply-chain protection. Patchstack points to the Advanced Responsive Video Embedder case, where Wordfence found a planted backdoor in a plugin with about 20,000 installs two hours after the malicious code landed. The issue was tracked as CVE-2026-18072 with a CVSS score of 9.8, and WordPress.org pulled it the same day.
Patchstack is careful not to claim the hold definitely caused the save. Still, the timing fits the kind of risk this policy was designed for: stop a suspicious new release before it is widely distributed.
Where security patches get stuck in the same queue
The problem is that malicious releases and legitimate security fixes are very different things, but Patchstack says the update gate treated them almost the same. Across 114 resolved releases, confirmed security releases and routine releases waited about 24.4 hours before July 16 and about 6.8 hours after.
During a 17-day window, Patchstack tracked 81 releases that patched disclosed CVEs, covering 79 distinct plugins with roughly 9.9 million combined installs. Thirty of those fixes had CVSS scores of 7.0 or higher, and nine were 9.0 or higher, including one CVSS 10.0 arbitrary file deletion vulnerability.
The dashboard may not tell the whole story
Patchstack gives examples where plugin pages and metadata already showed fixed versions, while the WordPress update-check API still served older vulnerable versions. It cites AcyMailing, where version 10.11.1 fixed an unauthenticated SQL injection but update-check still served 10.11.0, and Page View Count, where the page showed 2.9.2 while update-check remained on 2.9.1.
That is the practical trap. If your dashboard says everything is current, most people will stop there. They will not delete and reinstall a plugin or download a ZIP manually just to check whether the button is telling the truth.
Why agencies and hosts should care
This is not only a single-site problem. Patchstack notes that agencies, maintenance teams, and hosting companies often use central tools that still depend on the same WordPress.org update mechanism underneath. If that API is delayed, the management tool may also be delayed.
For a host or agency, that can turn a 6-hour blind spot into a fleet-wide blind spot. The update workflow may be fast, automated, and nicely reported in a dashboard, but if the underlying source is late, the automation is just very efficiently waiting.
What to do now
For normal updates, the WordPress dashboard remains the sane default. For critical vulnerability alerts, Patchstack’s analysis is a reminder not to rely only on the admin update screen. Check trusted security sources, plugin changelogs, and the official plugin page when a serious CVE affects a plugin you use.
If a fixed version exists but WordPress admin does not offer it yet, assess whether a safe manual update path is appropriate for your site. Test where possible, keep backups, and be especially careful on WooCommerce stores where a bad update can cost money quickly. For the full data and examples, read the original Patchstack article: Protect The Shire solves one problem, but risks making another worse.
Frequently Asked Questions
What is Protect The Shire in WordPress.org?
Protect The Shire is a WordPress.org policy announced on June 5, 2026, to add a hold before new plugin and theme releases are served through the normal update mechanism.
Does the delay affect manual plugin updates in WordPress admin?
Yes. Patchstack says both automatic updates and the manual Update Now button depend on the same update-check system, so both can be affected by the gate.
How long did Patchstack measure the update delay?
Patchstack measured median gate times of about 24.2 to 24.5 hours from July 7 to July 15, then about 6.6 to 6.8 hours starting July 16.
Can WordPress show no available update while a fixed plugin version exists?
Yes. Patchstack cited cases where plugin pages and metadata showed fixed versions, while the WordPress update-check API still served older vulnerable versions.
What should site owners do for critical plugin vulnerability alerts?
For serious CVEs, Patchstack’s analysis suggests checking trusted security sources, plugin changelogs, and the official plugin page instead of relying only on the WordPress admin update screen.