In reply to Trevor.

Plugins are PHP files that are simply included by WordPress. They can do anything WordPress can. There is no sandboxing of the code they can run.

So, suggesting that core "scan" the file for malicious code is not helpful, because to date, nobody has actually created anything that can actually "scan" for maliciousness. Virus scanners and the like rely on "signatures" and other similar types of mechanisms to identify already known sets of code. Some have heuristic mechanisms to identify possible bad code, however such methods are not very good and have frequent false positives.

The short of it is that there is no way to check for "intent". I can write a piece of code that includes a script from a third party site. Is that good or bad? The script could be to include a Facebook sharing button, or it could include a piece of javascript that steals your authentication credentials. How do you know that it's bad? Do you scan that script? What if I make it such that it only returns the bad script when it's included by a very specific site?

For any type of "scan" you could perform in an automated manner, somebody else can usually trivially modify their code to pass the test. Thus, making the scan public knowledge is not useful to protect against bad actors.

Theme Check, for example, does not have the primary purpose of making themes safe, it has the purpose of helping theme authors make sure they didn't forget anything. In that respect, it doesn't need to be a secret, it actually needs to be public information. If we write a Plugin Check, it's not going to try to detect malicious code either. It's going to check for things like copyright info, incompatible licenses, use of code that can cause incompatibilities, things that will help plugin authors improve their plugins. Any "security" checks it does will be fairly meaningless. We can do things like checking for unescaped inputs and such, but even then it's going to have false positives. No check is perfect.

And nothing "built into core" will secure your site from a malicious plugin that you actually install and turn on yourself. We don't have a PHP sandbox environment to work with, and there's no real plans to create one. The best defense is simply one of trust. Don't install plugins and themes from untrustworthy sources. If you find something bad in the official directories, you can email us about it and we'll take actions to mitigate the problem, fix up sites, ban those authors, etc. We do it on a regular basis. We get reports of security issues in plugins all the time. We get the plugins fixed and updates pushed. Reporting and rapid mitigation is the strategy here.