Does the EU Cyber Resilience Act apply to my WordPress plugin?

Short answer (it depends): Commercially supplied plugins (paid, or free with a paid upsell/pro version) can be PDEs. Purely free, non-monetised hobby plugins are less likely in scope; the commercial context is what matters.

What it means for a WordPress plugin

• Freemium plugins with a Pro version are generally in a commercial context.
• WordPress.org listing alone doesn’t make you a manufacturer; monetisation does.
• Agencies building custom plugins for one client: check who places it on the market.
• Your plugin’s update mechanism is your security-update channel.

Key dates

• 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
• 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).

FAQ

• I’m based outside the EU? Making your WordPress plugin available to EU users can still bring you in scope.
• What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.

Related: 24h reporting for WordPress plugins · CVD policy

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30