How to check who owns a WordPress plugin

There is no button for this. WordPress.org publishes everything you need, in two places, and never joins them up for you. Here is the whole method.

1. Read the directory page

Open https://wordpress.org/plugins/<slug>/ and scroll to Contributors & Developers. You get two things:

The listed author - a display name, which is free text and can be changed at any time without any other change.
The contributor usernames - actual WordPress.org accounts, linked to profiles.

Write both down. The author line is the one that changes most visibly when a plugin is sold, and it is also the one that tells you least, because it is a label rather than a permission.

2. Read the commit log

Open https://plugins.svn.wordpress.org/<slug>/. This is the plugin's actual repository, public, no account needed. The trunk directory is current development and tags holds released versions.

What you want is the commit history: who committed, and when. The directory page also exposes this under its Development tab, which is easier to read if you are only checking one plugin.

Note every username that appears, and the revision number of its earliest commit.

3. Compare the two lists - this is the step that matters

Listed contributors and people with commit access are not the same set. Almost every guide to this treats them as interchangeable, and they are not.

The contributor list is a directory display field. Commit access is the permission that actually ships code to your site. Someone can be added as a committer without appearing in the contributor list, and someone can sit in the contributor list for years having never committed anything.

So when you compare, ask a specific question: is there a username in the commit log that is not in the contributor list, and that has never committed to this plugin before?

That is the signal. Not the author name changing, which is cosmetic and often lags. A new committer is the first moment at which someone new can ship code to every site running that plugin.

4. Decide whether it is legitimate

Most transfers are entirely legitimate. Plugins are sold, maintainers hand over, agencies take on abandoned tools. A new name is a question, not a verdict. Three things usually settle it:

The changelog. A real handover is often announced there, or in a release post.
The support forum. Look for the new maintainer introducing themselves, or users asking who is running things now.
The new username's profile. Open https://profiles.wordpress.org/<username>/. What else do they commit to? How long has the account existed? An account created last month that now has commit access to a plugin with 90,000 installs is worth ten more minutes of your time.

Then read the actual diff at that revision. Most of the time it is a version bump.

What about premium plugins?

You cannot do any of this. A plugin distributed from a vendor's own site has no public directory page and no public commit history, so there is no record to compare against. That is not a gap in your process; it is a gap in what exists.

It is worth being honest with yourself about that rather than assuming a premium plugin is safer because you paid for it. The June 2026 ShapedPlugin compromise was a premium product, shipped through the vendor's own pipeline, and no public record would have shown anything.

Doing this at scale

Three minutes per plugin is fine once. A single WordPress site runs twenty to forty plugins. An agency with thirty client sites is looking at several hundred installs, and the check is only useful if you repeat it - a transfer you looked for last March tells you nothing about one that happened in June.

Which is why almost nobody does it, and why the April 2026 backdoor sat in a portfolio of 31 plugins for eight months with the evidence public the entire time.