When this plugin was activated, WordPress was updated unintentionally without confirmation

[an2009]

I installed MainWP Child to a WordPress site and added the site in the MainWP dashboard. Immediately after that, the child site was updated from 6.0.2 to 6.4.1 even though I didn’t do anything other than activating the plugin.

Since WordPress doesn’t create any activity or update logs, I have no idea what was the trigger for the update. Could someone tell me what are possible causes of the update?

The dashboard site: WordPress 6.4.1, PHP 8.0, MainWP Dashboard 4.5.3.2
The child site: WordPress 6.0.2, PHP 8.0, MainWP Child 4.5.3

[bojan (Bojan Katusic)]

Hi @an2009

Welcome to the MainWP community.

MainWP Dashboard does have a functionality to automatically update WP Core on child sites however, certain WP Core has to be marked as Trusted, which can only be done by the user.

So we believe that this had to be just a coincidence.

Does your hosting have any kind of logs that you can check? Or perhaps the hosting support may be able to help you discover what triggered the update?

[an2009]

Hi, @bojan, thank you for your response.

MainWP Dashboard does have a functionality to automatically update WP Core on child sites however, certain WP Core has to be marked as Trusted, which can only be done by the user.

I checked Updates Settings in the dashboard and found that WP Core advanced automatic updates is set to Install Trusted Updates. Could this be one of the possible causes? (Should I disable it?) Also could you tell me where can I mark certain WP core as Trusted or not?

Does your hosting have any kind of logs that you can check? Or perhaps the hosting support may be able to help you discover what triggered the update?

I only have the access logs and error logs of nginx. An excerpt from the access log is the following:

xx.xxx.xx.xxx - user [30/Nov/2023:16:01:27 +0900] "POST / HTTP/1.1" 200 124543 "https://dashboardsite" "Mozilla/5.0 (compatible; MainWP/4.5.3.2; +http://mainwp.com)"
xx.xxx.xx.xxx - - [30/Nov/2023:16:02:10 +0900] "POST /wp-admin/admin-ajax.php HTTP/1.1" 403 199 "https://dashboardsite" "Mozilla/5.0 (compatible; MainWP/4.5.3.2; +http://mainwp.com)"
xx.xxx.xx.xxx - user [30/Nov/2023:16:02:10 +0900] "POST / HTTP/1.1" 200 97 "https://dashboardsite" "Mozilla/5.0 (compatible; MainWP/4.5.3.2; +http://mainwp.com)"
xx.xxx.xx.xxx - - [30/Nov/2023:16:02:11 +0900] "POST /wp-admin/admin-ajax.php HTTP/1.1" 403 199 "https://dashboardsite" "Mozilla/5.0 (compatible; MainWP/4.5.3.2; +http://mainwp.com)"
xx.xxx.xx.xxx - user [30/Nov/2023:16:02:11 +0900] "POST / HTTP/1.1" 200 37537 "https://dashboardsite" "Mozilla/5.0 (compatible; MainWP/4.5.3.2; +http://mainwp.com)"

After this, the child site was updated. (There are some 403 Forbidden in the log because the site uses BASIC auth)
Please let me know if you can see any clue from this.

[bojan (Bojan Katusic)]

@an2009

I checked Updates Settings in the dashboard and found that WP Core advanced automatic updates is set to Install Trusted Updates. Could this be one of the possible causes? (Should I disable it?) Also could you tell me where can I mark certain WP core as Trusted or not?

That option alone is not enough to automatically update WP Core on the child site.

In addition to that, Auto update core option on the Edit page of a Child site should have been manually enabled:

@an2009

I only have the access logs and error logs of nginx. An excerpt from the access log is the following:

These logs do not indicate that MainWP initiated the automatic update. So unless the Auto update core option was enabled for that specific site, it was almost certainly a coincidence that it occurred around the time of adding the site to the Dashboard.

[an2009]

Hi, @bojan,

In addition to that, Auto update core option on the Edit page of a Child site should have been manually enabled:

Thank you for the screenshot. I’m sure I didn’t enable that option.

These logs do not indicate that MainWP initiated the automatic update.

I then also checked the error-log and found the following lines:

[Thu Nov 30 16:02:18.284300 2023] [php:warn] [pid 8859] [client xx.xxxx.xx.xxx:0] PHP Warning:  Undefined property: stdClass::$theme in /var/www/public/wp-admin/includes/class-wp-automatic-updater.php on line 322, referer: https://dashboardsite
[Thu Nov 30 16:02:18.284414 2023] [php:warn] [pid 8859] [client xx.xxxx.xx.xxx:0] PHP Warning:  Undefined property: stdClass::$theme in /var/www/public/wp-admin/includes/class-wp-automatic-updater.php on line 172, referer: https://dashboardsite

So I checked the actual class-wp-automatic-updater.php file of this version.

• The line 322 is inside public function update( $type, $item ).
• The line 172 is inside public function should_update( $type, $item, $context ).

Do these indicate that the access from the MainWP dashboard site caused the update? Any possibility?

[bojan (Bojan Katusic)]

@an2009

I then also checked the error-log and found the following lines:

[Thu Nov 30 16:02:18.284300 2023] [php:warn] [pid 8859] [client xx.xxxx.xx.xxx:0] PHP Warning:  Undefined property: stdClass::$theme in /var/www/public/wp-admin/includes/class-wp-automatic-updater.php on line 322, referer: https://dashboardsite
[Thu Nov 30 16:02:18.284414 2023] [php:warn] [pid 8859] [client xx.xxxx.xx.xxx:0] PHP Warn

This log still doesn’t indicate that the MainWP Dashboard made a request for a WP Core update.

The user has to explicitly mark the child site as Trusted for that to happen, and if it was indeed a bug related to it, we would have likely gotten reports for it.

Nevertheless, I will check with the development team for their interpretation of that error log and if it may be connected to the WP Core update in any way.

Did you perhaps install the MainWP Child reports plugin on that child site before the update occurred?
MainWP Child reports plugin logs changes on the child site and those logs are then used for Pro Reports extension.

[an2009]

Hi @bojan,

Unfortunately, l haven’t installed the MainWP Child Reports plugin on that site. (A premium extension would be required, right? I’m considering purchasing it.)

I’m pretty sure that I didn’t mark the child site as to be auto-updated, and I understand that it’s unlikely the MainWP triggered the update. Meanwhile, it turned out that the wp-cron of the WordPress had been disabled. So I’m still having difficulty figuring out why this update happened.

Another thing I remember is that the wp-admin page asked me to update database after the core update. Would the MainWP’s auto-update function update database automatically if necessary? If so, it means that it was not the MainWP who performed the update.

[bojan (Bojan Katusic)]

@an2009

Another thing I remember is that the wp-admin page asked me to update database after the core update. Would the MainWP’s auto-update function update database automatically if necessary? If so, it means that it was not the MainWP who performed the update.

These requests for database updates are usually not present when MainWP performs a core update, but they can occur, so this is not something we can use to exclude MainWP as a cause.

@an2009

I’m pretty sure that I didn’t mark the child site as to be auto-updated, and I understand that it’s unlikely the MainWP triggered the update. Meanwhile, it turned out that the wp-cron of the WordPress had been disabled. So I’m still having difficulty figuring out why this update happened.

The development team has looked into this and the logs you provided and they do not believe the Core auto-update was triggered by MainWP.

Nor could they think of a scenario where MainWP would trigger it without the user enabling the Auto update core option on the Edit page of a Child site.

Without additional logs or other information, it is rather hard to guess what actually caused it.