Premium Update Gate

Premium updates arrive with no review

Updates from WordPress.org can be checked by the directory before release. Updates to premium, commercial and custom plugins come straight from vendor servers. In 2026 attackers used that path: tampered builds of popular premium plugins shipped through the vendors’ own updaters, fetched a payload from a raw IP address, installed a hidden plugin and captured passwords, two-factor codes and SMTP credentials. File-integrity scanners missed it because they only compare files with WordPress.org.

What Premium Update Gate does

It inspects every update to a plugin that is not distributed by WordPress.org before its files replace the installed copy, for manual, bulk, AJAX, WP-CLI and background updates.

• Hashes every file of the new package and the installed copy with SHA-256 and diffs added, removed and changed files, with line diffs for text files.
• Scans only added and changed code for patterns from real supply-chain attacks: raw-IP and new-host calls, plugin installation and hiding, administrator creation, obfuscation, credential capture, cloaking and PHP in asset folders or images.
• Scores each update as Clean, Review or Hold. Held packages are quarantined as a zip and the update aborts cleanly with the plugin still active.
• Shows a review screen with the score, each finding with file, line and highlighted snippet, a full diff viewer and a plain-English summary. Approve and install the exact reviewed package, reject it, or trust the vendor for N days.
• Detects hidden plugins by comparing plugin headers on disk with the Plugins screen, and keeps a SHA-256 baseline of every in-scope plugin so files that change without an update raise an alert.
• Sends alerts by email and optionally to a Slack-compatible webhook, with a dashboard widget, History screen and wp pug WP-CLI commands.

Who it is for

Site owners, agencies and hosts that run page builders, form builders, WooCommerce extensions or custom code and want a second pair of eyes on every vendor update without reading diffs by hand. No other plugin is required; on multisite it is network-activated.

How it works

• Install and activate the plugin, enter your license key under Update Gate → License and check what is gated under Plugins in scope.
• Update as usual. Clean updates install straight away; anything at or above your Hold threshold is quarantined and you receive an alert.
• Open Update Gate → Pending reviews, read the findings and the diff, then approve, reject or trust the vendor.