Why would a plugin be removed from WordPress.org?

The directory does not say, which is the problem. Removal can mean an unfixed security hole, a guideline violation, or the author pulling it voluntarily. Because you cannot tell which from the outside, the safe reading is the worst one until proven otherwise.

Is this more urgent than an abandoned plugin?

Yes. Abandonment is neglect; removal is an action someone took, and a security-related removal often precedes public disclosure. Sites still running the plugin at disclosure time are the ones that get swept up. Find out why it was removed — search the plugin name with 'vulnerability' — and lean towards replacing it this week, not this quarter.

The plugin came back to the directory. Can I relax?

Reinstatement usually means the issue was fixed — but only the current release is fixed. Update to it; do not simply note that the listing exists again. Your installed copy is still whatever version it was when the listing vanished.

Glossary · Vulnerability

A plugin was removed from the WordPress.org repository

Wordfence type: wfPluginRemoved
Category: Vulnerability
Severity: Usually High

A plugin installed on the site is no longer available on WordPress.org, often because it was pulled for a security issue.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

The Plugin "example-gallery" has been removed from wordpress.org.

What Wordfence found

Wordfence found that a plugin present on the site no longer has a listing on WordPress.org. Plugins are pulled for several reasons: an unfixed security issue, a guideline violation, a trademark complaint, or the author withdrawing it.

Why it matters

A closed listing means no more updates will arrive through the normal channel, and the site will never be told about a future vulnerability. When the removal was for a security reason, the vulnerable code is still on the site and the usual signal that a patch exists is gone.

How to fix it

1Find out why it was removed. The WordPress.org page often states the closure reason and date.
2Treat a closure for security reasons as urgent: remove the plugin.
3Otherwise, plan a replacement, because the plugin will not receive updates.
4Do not reinstall from a third-party mirror — that is how backdoored copies spread.

Common questions

Why would a plugin be removed from WordPress.org?: The directory does not say, which is the problem. Removal can mean an unfixed security hole, a guideline violation, or the author pulling it voluntarily. Because you cannot tell which from the outside, the safe reading is the worst one until proven otherwise.
Is this more urgent than an abandoned plugin?: Yes. Abandonment is neglect; removal is an action someone took, and a security-related removal often precedes public disclosure. Sites still running the plugin at disclosure time are the ones that get swept up. Find out why it was removed — search the plugin name with 'vulnerability' — and lean towards replacing it this week, not this quarter.
The plugin came back to the directory. Can I relax?: Reinstatement usually means the issue was fixed — but only the current release is fixed. Update to it; do not simply note that the listing exists again. Your installed copy is still whatever version it was when the listing vanished.

How WPSecureOps treats it

The connector reports this as wfPluginRemoved. WPSecureOps files it under Vulnerability and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.