# A Safety Control That Cannot See Severity Becomes a Hazard ## Claim When a protective delay treats urgent and routine changes identically, it converts its own safety margin into an attacker's head start on exactly the changes that mattered. <!-- atomicity: 1 idea ✓ --> ## Evidence WordPress.org's Protect The Shire initiative placed a mandatory hold on plugin and theme releases before the update-check API would serve them — 24 hours initially, shortened to roughly 6 hours on 16 July 2026. The security rationale is sound and is not in dispute: plugins get sold to owners who insert backdoors, and a review window is a reasonable actor-vetting control. The defect is that the gate is blind to what it is holding. Patchstack measured 114 releases and found a median 24.4-hour delay, then split CVE-linked security releases from routine ones: > [!quote] > both held for almost exactly the same duration in each era: about 24.4 hours before July 16, about 6.8 hours after. A critical patch queues behind a button-colour change. Over one 17-day window, 81 CVE-patching releases moved through the gate across 79 plugins and roughly 9.9 million installs — thirty at CVSS 7.0+, nine at 9.0+, one a perfect 10. The mechanism that turns delay into exposure is the *ordering*: tag-to-downloadable is near-instant, so the fixed version and its changelog become public while the update-check API keeps serving the vulnerable one. AcyMailing's plugin page showed the SQL-injection fix at 10.11.1 while update-check still handed out 10.11.0. The fix is legible to anyone watching changelogs and invisible to the site owner, whose dashboard reports nothing pending. Against a measured 90 minutes from patch to exploitation, a 6-hour hold is not a shortened risk window — it is a guaranteed one. An exception path exists, requiring a developer to specifically ask the plugin team. A manual carve-out only protects developers who know it exists and have time to use it, which is why the fix is automatic severity-awareness keyed to CVE linkage rather than a faster uniform gate. ## Scope & conditions - **Holds** where the delay is uniform *and* the underlying change becomes public during it — the publish-then-gate ordering is what creates the exposure. - **Strongest** where downstream tooling inherits the gate, so the blind spot applies to an entire fleet simultaneously rather than one site. - **Breaks** where the gate also conceals the change: if no public repository or changelog reveals the fix, the delay buys genuine review time at no disclosure cost. - **Breaks** where severity cannot be machine-determined at gate time, which is the real implementation difficulty rather than an argument against the principle. - **Ledger caveat:** Patchstack measures only what the gate costs and never what it prevents. If the hold has intercepted backdoored releases, that belongs on the other side of the comparison, and nobody has published it. ## Links - [[3. Resources/Permanent Notes/Supply-Chain Defense Tracks Bad Actors Not Bad Code]] — extends: that note explains why the cooldown exists as an actor-vetting control; this one shows the cost of implementing it without severity awareness - [[3. Resources/Permanent Notes/Update Signatures Prove Provenance Not Freshness]] — contrasts on which property the update channel guarantees: signatures establish who authorized a release, this gate delays whether you learn it exists - [[3. Resources/Permanent Notes/Zet · Rapid weaponization outpaces manual update workflows]] — evidence-for: the speed gap this note measures is the same one, seen from the distribution side rather than the discovery side - [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] — applies-in: the 90-minutes-to-exploitation figure is the cost collapse that makes a 6-hour gate untenable - [[3. Resources/Permanent Notes/WordPress's Compatibility-First Culture Is Now Its Binding Security Constraint]] — contrasts on how caution scales: install-base size justifies the gate and also magnifies what the gate delays - [[WordPress Hosting Security Stack MOC]] — home for update distribution, patch cadence, and directory policy - [[3. Resources/Readwise/Articles/Vulnerability Response for Large Open Source Projects - Jo Guerreiro & Charline Voinot, Grafana Labs]] — extends: Grafana's own rule ("the score starts the conversation, context chooses the action") is the same severity-must-drive-response principle stated from the receiving side of a vulnerability, not the distribution side — CVSS sets a baseline; deployment context, exploitation evidence, and mitigation availability determine the actual response level. ## Source - [[3. Resources/Readwise/Articles/The WordPress Update Button Isn't Telling the Truth Anymore - Patchstack]] — Patchstack, 2026; 114 releases measured across three timestamps, security-versus-routine control comparison, AcyMailing and Page View Count worked cases. Note the vendor sells the protection that routes around this gap.