Custom/Private Plugins not in the Wordpress Repository

[Jim537]

PCP checks for naming collisions with plugins in the Wordpress Repository and reports if issues are found.

I would like to propose a new feature to extend this name collision check for the benefit of End Users.

This would warn an End User if the plugin they are checking is not in the Wordpress Repository. Also to provide cautionary advise that the plugin has not been subject to the more extensive testing that is normally required. Maybe with a security caution message/icon.

End Users might find this useful in cases where the website was constructed by others or in situations where security issues were a concern.

[davidperezgar]

Thanks for writing this up — the concern is real, especially on sites someone else built.

One clarification on the starting point: PCP doesn't do a Directory lookup as such. The Plugin Namer tool is an AI evaluation of a proposed name against the naming guidelines — trademarks, generic names, names likely to be confused with an existing one — and it's advisory, with final naming decisions resting with reviewers. So there's no yes/no "is this in the Directory" result to extend here.

You're right that hosted plugins go through more than plugins distributed elsewhere. Since June, every release is analysed for security issues during a cooldown window before it reaches the update API, and high-risk releases are blocked automatically. That's a real difference, and it's worth knowing about.

Where the proposal breaks down is the inference. Absence from the Directory isn't a risk signal on its own — premium plugins, plugins built for a single client and host-bundled plugins are all legitimately absent, so the warning would fire across much of a typical site's plugin list. And it fails in the case you're most worried about: a tampered or nulled copy of a popular plugin keeps the original name and slug, so a name match would clear it.

If the question is "are these files what the author actually published", wp plugin verify-checksums --all in WP-CLI answers it directly. Directory-hosted plugins only, but it's real integrity checking rather than a name match.

[Jim537]

Ok appreciate your reply - a couple of questions/ideas.

1. 'PCP doesn't do a Directory lookup as such'

My interest in this issue was first raised when I got a PCP Warning of "plugin_header_requires_plugins_not_in_directory" and "The plugin declares “xxxx-xxx” as a required plugin, but it could not be found in the WordPress.org plugin directory".

So if PCP has given this message then the necessary 'lookup' is already present and working ?

2. "inference" - I get your point which is important. What about just a factual information message saying that the plugin has not been reviewed by Wordpress for operation and security. Referring the End User to the plugin author for further support ?

3. If the plugin name was in the directory but with different code (so with the potential of malware) then PCP would pass this test. That is another issue that could also apply to any (registered) plugin on the server which could have been tampered with.