When to Reinstall a WordPress Plugin From Its Official Source (Instead of Just Updating)

WordPress decides whether a plugin needs updating by comparing its installed version number against the latest version WordPress.org has published. That works well for its intended purpose -- keeping software current -- but it has a specific blind spot: if a plugin's files were modified without changing the version string, WordPress has no way of knowing anything is different, and 'Update' won't even appear as an option.

This is exactly the gap a certain kind of attack is designed to exploit. Injecting a file into an existing plugin's folder, or modifying one of its files directly, without bumping the version number means the tampering survives indefinitely as long as nobody looks closely, since the plugin will keep reporting itself as fully up to date.

A genuine reinstall-from-source doesn't check whether an update is available at all -- it redownloads the plugin's current official release from WordPress.org unconditionally and replaces every file the plugin ships with a clean copy. Just as importantly, it also removes any file present in the plugin's folder that isn't part of the official package, which is the piece a normal update entirely skips, since an update only concerns itself with files it recognizes as its own.

Reinstalling from source is the right move whenever you suspect a plugin's files were tampered with directly -- following a security scan finding, after a hosting-level compromise affecting multiple sites, or simply as due diligence after any incident where you can't be fully certain what was touched. It's not a substitute for quarantine when the concerning file isn't actually part of a real plugin at all -- a standalone dropper sitting in an upload folder should be quarantined, not 'reinstalled,' since there's no official version of a file that was never legitimate to begin with.

It also only works for plugins genuinely distributed through WordPress.org; a premium plugin sold outside that repository has no public official-release URL to redownload from, and needs reinstalling manually from the vendor instead. WPFixAgent's Reinstall action handles the WordPress.org case end to end -- snapshotting the current plugin first so the action is fully reversible, then rebuilding it to match the official release exactly.