Plugin activation is the point at which a WordPress plugin is enabled and its code can run within the site. Depending on the plugin, code may execute during page requests, administrative actions, or scheduled tasks. Installing a plugin alone does not always mean its functionality is running; activation makes it available to the site.
Activation matters for security because plugin code typically operates with the privileges granted to the WordPress installation. A malicious or vulnerable plugin may therefore be able to alter files or database content, create unauthorized accounts, or make network requests. In a software supply-chain incident, activating a tainted package can turn a distribution problem into an active site compromise. Disabling or replacing the plugin stops its normal execution but does not prove that changes made while it was active have been removed, so review affected files, accounts, scheduled tasks, and logs.