Auto-update happened (despite it is disabled)

  • Unknown's avatar
    midnightrendszergazda · Member ·

    Hi,

    Yesterday late at night I got a notification: A new version of the plugin “Wordfence Security (v7.5.4)” is available.

    As I logged in today first thing in the morning, I found that the plugin was already updated.

    This has never happened before. >> I have manually updated all kinds of plugins and themes hundreds of times, there was never a case of an automatic update happening before for the past five years.

    Auto-update is DISABLED for all plugins. >> So no update should have happened.

    I am the only Administrator of the site. >> So no one else should have been able to update the plugin.

    No user login notification was received. >> I monitor every login so even if this would be a case of mismanaged Editor privileges on my part, no user, ANY user logged in from the time of the update notification till I saw that the update already happened. (Yes, I have checked and no Editor has more than editor privileges and there are no other users created, only the Editor’s and my Administrator account exists.)

    The last time this was working correctly, a plugin (NextGen Gallery) was manually updated on the 27th of May, 2021. No changes were made to the site configuration since then.

    Is this a bug, an unknown feature of Wordfence, or a serious if not malicious security breach by the plugin update fairy?

    How worried should I be? >> Hope this never happens again/will be resolved as it’s merely a WordPress/Wordfence bug/kink or panic because this is de facto proof of breach of the site security?

    Any advice how to proceed from here?

    Thanks in advance,
    Thomas

  • Unknown's avatar
    staartmees · Member ·

    We can’t help you as your site is using the open source wordpress.org. Their support is at https://wordpress.org/.
    I can tell you for sure forced security updates are always possible as last week happened, “WordPress.org pushed a forced update to all vulnerable versions, surprising those who have auto-updates disabled.”

  • Unknown's avatar
    midnightrendszergazda · Member ·

    Thanks!

    Sorry, this com/org thingy is a bit confusing, and I got tripped by it. The two sites being 99% the same did not help.

  • Unknown's avatar
    midnightrendszergazda · Member ·

    Thanks

  • The topic ‘Auto-update happened (despite it is disabled)’ is closed to new replies.