Introduction
Plugins from WordPress.org can be reviewed by the directory before a release goes out. Updates to premium, commercial and custom plugins arrive straight from the vendor’s own server with no review at all. In 2026 attackers used exactly that path: tampered builds of popular premium plugins were shipped through the vendors’ official updaters, installed a hidden plugin and captured passwords, two-factor codes and SMTP credentials. File-integrity scanners did not notice, because they only compare files with WordPress.org.
Premium Update Gate closes that gap. Every update to a plugin that is not distributed by WordPress.org is unpacked, hashed and diffed against the installed copy before anything is installed. Only the added and changed code is scanned for patterns used in real supply-chain attacks. Clean updates install as normal. Risky ones are quarantined and held until an administrator approves or rejects them.
It is built for anyone who runs premium plugins on a site they care about: store owners, agencies that maintain client sites, and hosts that manage many installs.
What it is best at#
- Gating premium updates on every update path: manual, bulk, AJAX, WP-CLI and automatic background updates.
- Explaining why an update was held, with a score, each finding at its file and line, a highlighted code snippet, a full diff viewer and a plain-English summary.
- Detecting hidden plugins by reading plugin headers straight from disk and comparing them with what the Plugins screen shows.
- Watching file integrity with its own SHA-256 baseline of every in-scope plugin, so files that change without an update raise an alert.
Next steps#
- Check the Requirements.
- Follow the Installation steps and activate your license.
- Walk through the Quick Start to see your first inspected update.