Cyber Resilience Act: what WordPress plugin sellers must do

If you sell a premium WordPress plugin or theme to customers in the EU, the Cyber Resilience Act (CRA) already applies to you. Since 11 September 2026, you must report actively exploited vulnerabilities and severe incidents affecting your products, starting with an early warning within 24 hours. The larger set of duties, from security requirements and a software bill of materials (SBOM) to security updates and CE marking, applies from 11 December 2027.

This guide covers who counts as a manufacturer, what reporting means in practice, and what to do now. The legal text is Regulation (EU) 2024/2847.

Are you a manufacturer under the Cyber Resilience Act?

The CRA covers "products with digital elements" made available on the EU market in the course of a commercial activity. A premium WordPress plugin or theme sold to EU customers is such a product, and the person or company that develops it and sells it under its own name is its manufacturer. That applies whether you are based inside or outside the EU.

Free, freemium and paid plugins

Free and open-source software that is not monetised is generally outside the manufacturer regime. A hobby plugin on WordPress.org without any paid tier, or code you contribute to someone else's project, are typical examples.

Freemium models are less clear. The CRA's recitals list signs of commercial activity: charging a price for the product, charging for support beyond cost recovery, monetising through a platform or other services, requiring personal data as a condition of use for reasons beyond security, compatibility or interoperability, and accepting donations that exceed costs. A free "lite" plugin that mainly exists to sell a Pro version or a paid service may therefore count as commercial. If that describes your business, plan as a manufacturer and get legal advice on the details.

Open-source software stewards

The CRA also introduces "open-source software stewards": legal persons, such as foundations, that systematically support the development of free open-source software intended for commercial activities without being its manufacturer. Stewards have a lighter regime, and their reporting obligations apply from 11 December 2027.

Why your website is not a CRA product

A website or a hosted service as such is generally not a "product" under the CRA. Remote data processing is only covered when it is essential to a product's function. Your company website, your shop and your customer portal are therefore generally not CRA products, and running a WordPress site does not make you a manufacturer. A cloud service that your plugin cannot work without is a case to check carefully.

For site owners, the CRA works indirectly, through the duties of their plugin and theme vendors. Their own duties come from the GDPR and, for some, from NIS2.

The CRA timeline for WordPress plugin sellers

• 10 December 2024: the CRA entered into force.
• 11 June 2026: the provisions on conformity assessment bodies apply.
• 11 September 2026: the reporting obligations for manufacturers apply.
• 11 December 2027: the main obligations apply, including the essential cybersecurity requirements, conformity assessment and CE marking.

Reporting since 11 September 2026: 24 hours, 72 hours, 14 days

The reporting duty covers two kinds of events. An actively exploited vulnerability is one for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. A severe incident affects the security of your product, for example by leading, or being able to lead, to malicious code in your product or in your users' systems. For a plugin vendor, a compromised update or license server that ships a backdoored release is a clear example.

The duty also applies to products placed on the market before 11 December 2027 (Art. 69(3)). In other words, it covers the plugin versions your customers run today.

The clocks start when you become aware of the vulnerability or incident. Reports go through ENISA's CRA Single Reporting Platform, operational since 11 September 2026, to the CSIRT of the Member State where you have your main establishment in the EU (other rules apply if you have none). ENISA receives them at the same time. You must also inform the impacted users, and where appropriate all users, about the issue and the mitigation steps they can take.

A realistic scenario: a security researcher or a hosting company tells you that a flaw in your plugin is being used in attacks. From that moment, the 24-hour clock runs. Our guide to vulnerable WordPress plugins shows how quickly such flaws are exploited once they are public. If personal data was exposed as well, for example on your own license server, GDPR breach rules apply in parallel; see the GDPR 72-hour breach notification.

What applies from 11 December 2027

From December 2027, the full manufacturer obligations apply to the plugins and themes you place on the market. Products placed on the market before that date are only covered if they are substantially modified afterwards (Art. 69(2)). The main duties:

• Security by design, and no known exploitable vulnerabilities at release.
• Secure-by-default configuration.
• A support period during which you handle vulnerabilities. It is generally at least five years, unless the product is expected to be in use for less, and its end date (at least month and year) must be clear at the time of purchase.
• Security updates distributed without delay, free of charge and with advisory messages. Check how this fits a license model where updates stop when a subscription ends.
• A vulnerability handling process and a coordinated vulnerability disclosure (CVD) policy, plus a single point of contact that users can reach quickly.
• An SBOM in a machine-readable format covering at least the top-level dependencies. For a plugin, think of Composer and npm packages and any bundled libraries.
• Technical documentation, a conformity assessment and the CE marking.

Some product types are listed in Annex III as "important products" with stricter conformity assessment rules. They include software that searches for, removes or quarantines malicious software, password managers, and identity management and privileged access management software (class I), as well as firewalls and intrusion detection and prevention systems (class II). If your plugin is a security product, check these categories carefully.

Fines under Article 64

Breaching the essential cybersecurity requirements or the manufacturer obligations, including the reporting duty, can lead to fines of up to €15 million or 2.5 % of worldwide annual turnover, whichever is higher. One relief for small vendors: microenterprises and small enterprises cannot be fined for missing the 24-hour early-warning deadline, and open-source software stewards cannot be fined under the CRA at all. For micro and small manufacturers, the 72-hour notification and all other duties remain enforceable.

A to-do list for WordPress plugin vendors

• List every paid plugin, theme, add-on and freemium product you offer to EU customers, and decide where you are the manufacturer.
• Set up a vulnerability intake that works within 24 hours: a security contact address, a security.txt file on your website, a monitored inbox and a named deputy for holidays.
• Write down your reporting procedure: who decides whether a vulnerability is actively exploited, who files on the Single Reporting Platform, and who drafts the user advisory.
• Prepare templates for the early warning, the 72-hour notification and the final report.
• Publish a coordinated vulnerability disclosure policy.
• Generate an SBOM for each release (CycloneDX and SPDX are common formats) and store it with the build.
• Protect your release pipeline: multi-factor authentication on every account that can publish code, and hardened update and license servers.
• Define a support period for each product and plan how customers with expired licences receive security fixes.
• Start the technical documentation: architecture, data flows, risk assessment and test results.
• Check whether any of your products falls under Annex III.

As one extra check before a release, the free Security Audit & Compliance plugin from secaudit.eu includes a code vulnerability (taint) analysis of plugins and themes. It complements your own code review and testing; it does not replace them.

FAQ

Does the CRA apply to free plugins on WordPress.org?

Generally not, if the plugin is not monetised. If the free version serves as a funnel for a paid product or service, it may count as commercial activity, so get advice.

I only build client websites. Am I a manufacturer?

Not for the website itself: a website as such is generally not a CRA product. If you also sell a plugin or theme on the EU market, you are the manufacturer of that product.

This article is general information, not legal advice.