The WordPress Security Team has been hardening GitHub Actions workflows across the WordPress GitHub organization for the past 18 months to help protect against software supply chain attacks that have targeted GitHub repositories across the industry. The effort is ongoing, with additional organization-wide security measures planned.
GitHub Actions security remains a long-term focus for WordPress
John Blackbourn detailed how recent supply chain attacks have exploited weaknesses in GitHub Actions workflow files and published actions across multiple GitHub organizations and repositories. According to the post, such attacks can lead to malicious releases being published, backdoors being inserted into packages, and the exposure of secrets such as API keys.
Blackbourn cited incidents involving TanStack, actions-cool, BitWarden, Microsoft, DataDog, the Cloud Native Computing Foundation (CNCF), and the tj-actions organization. Blackbourn wrote that many of these attacks exploited misconfigured workflows that granted higher-than-necessary permissions, used the pull_request_target trigger in an unsafe manner, or did not make use of dependency pinning.
Blackbourn noted that “The WordPress project isn’t immune to these attacks, but fortunately it’s so far not directly been affected due to several rounds of hardening applied to workflow files over the last 18 months. This work remains ongoing.”
He also outlined a timeline of security improvements introduced across the WordPress GitHub organization between January 2025 and July 2026. In January 2025, the wordpress-develop repository received significant workflow hardening, and Actionlint, a static checker for GitHub Actions workflow files, was introduced.
Similar hardening and the introduction of Actionlint followed in the Gutenberg repository in April 2025. In June 2025, the project archived 20 unmaintained repositories, ending their GitHub Actions workflows.
The Security Team expanded its efforts in 2026 by introducing the Zizmor, a static analysis tool to the wordpress-develop repository and publishing GitHub Actions Workflow Standards in April. In May, it hardened workflow files across multiple repositories, strengthened a reusable workflow used across dozens of repositories in the WP-CLI organization, further secured workflows using the pull_request_target trigger in the wordpress-develop repository, and updated the HackerOne bug bounty program to explicitly include supply chain and CI/CD workflows. In July 2026, Zizmor was also introduced to the Gutenberg repository.
Blackbourn wrote that several of these changes tightened workflow permissions to ensure “each workflow runs with the lowest permissions required for each job,” reducing the risk of attackers exploiting exposed tokens or elevating their permissions beyond what is minimally necessary.
Looking ahead, Blackbourn said the long-term plan is to implement Actionlint and Zizmor scanning and enforcement at the organization level rather than in individual repositories to ensure “every repository consistently follows secure best practices within Actions-related files.” Blackbourn added that contributors can expect more pull requests to be opened across WordPress repositories in the coming weeks as part of the continued effort to harden workflow files by addressing issues flagged by Actionlint and Zizmor.
The Security Team is also discussing a standardized security policy for repositories within the WordPress GitHub organization, which could include a central SECURITY.md file and a corresponding HackerOne policy. Once that work is complete, the team plans to implement additional organization-wide repository security policies, including immutable releases, secret scanning, and required rulesets. Blackbourn also added that guidance on secure Node and npm configuration is expected after the wordpress-develop and Gutenberg repositories are updated to at least Node v24.
Recent incidents highlight supply chain risks in the WordPress ecosystem
The security hardening efforts also come amid a series of supply chain incidents affecting the WordPress ecosystem. Recent cases include a compromise of ShapedPlugin’s premium plugin distribution pipeline that resulted in backdoored plugin updates being delivered to customers, the temporary closure of more than 80 WPFactory plugins on WordPress.org following reports of a suspected backdoor in a premium plugin distributed through the company’s website, and multiple supply chain attacks involving Awesome Motive products, including OptinMonster, TrustPulse, PushEngage, MonsterInsights, and Uncanny Automator.
Contributors interested in helping secure GitHub Actions workflow files can participate in the effort by commenting on the announcement post or joining the discussion in the #core-build-test-tools Slack channel on the WordPress Slack workspace.