The plugin was updated automatically. Why?

  • Resolved ronbi13

    (@ronbi13)


    1 month, 3 weeks ago

    Good afternoon. I have a ban on automatic updates of all plugins. But your plugin has been updated automatically on all my sites today. Why did this happen?

Viewing 13 replies - 1 through 13 (of 13 total)
  • Plugin Support Frank Remmy (woo-hc)

    (@frankremmy)

    1 month, 3 weeks ago

    Hi @ronbi13,

    Good afternoon! I understand your concern about the automatic update happening despite having automatic updates disabled for all plugins.

    If you have a ban on automatic updates for all plugins, but WooCommerce updated automatically on your sites, there are a few potential reasons this might have happened:

    • Sometimes, critical security fixes are pushed as forced updates by WooCommerce to ensure site safety. These can override your automatic update settings for other plugins.
    • Some managed hosting environments have their own policies or systems that automatically update certain essential plugins, including WooCommerce, for security and stability.
    • Check if there is a custom rule in your wp-config.php or via other plugins specifically allowing WooCommerce updates.
    • If using WooCommerce Admin or related background services, they sometimes trigger updates in the background for important patches.

    To better assist you, could you please share:

    • How you have set the ban on automatic updates? (e.g., via code snippets, plugin, or hosting controls)
    • Whether your hosting provider has any update policies?
    • Which versions did the WooCommerce plugin update from and to, if you know?

    Understanding this will help pinpoint why WooCommerce bypassed your plugin update ban.

    Looking forward to your response.

    Thread Starter ronbi13

    (@ronbi13)

    1 month, 3 weeks ago

    Am I correct in understanding that you have forcibly updated the plugin for all users?

    dyin

    (@dyin)

    1 month, 3 weeks ago

    @ronbi13 chill, it wasn’t on my site. There must be some other reason. Hosts could have their own policy too

    Plugin Support Frank Remmy (woo-hc)

    (@frankremmy)

    1 month, 3 weeks ago

    Hi @ronbi13,

    There’s no indication of a forced update being pushed from our side. As @dyin mentioned, many hosting providers could have their own policies or automated systems that can override WordPress‑level update settings for security reasons. To help narrow this down, please share the additional information as requested.

    Once we have that information, we can help you pinpoint the exact cause. Looking forward to your update.

    irocwebs

    (@irocwebs)

    1 month, 3 weeks ago

    Just received this from WooCommerce:

    Hello,

    We’re reaching out to let you know that a security vulnerability identified in WooCommerce has been patched. If your store runs WooCommerce version 8.1 or newer, we recommend updating to the latest version, WooCommerce 10.4.3, as soon as possible. At this time, we have no indication that this vulnerability has been exploited. 

    If your store has automatic updates enabled, or if your store is hosted by Automattic (via WordPress.com, Pressable, WordPress VIP, or with any host using WP Cloud), the patch should already be applied. You can check your version by following the steps below.

    What you should do
    While there is no indication that this vulnerability has been exploited, you should update WooCommerce to the latest patched version,10.4.3, as soon as possible. You can do this by:

    1. Going to Dashboard → Updates in your WordPress admin.
    2. Select WooCommerce.
    3. If your current version of WooCommerce is 10.4.3, no further action is necessary.
    4. If you are not using version 10.4.3, or if you see “Update now,” please click on that link to get the latest version.

    What happened
    A security researcher recently reported a vulnerability in WooCommerce’s Store API that could allow logged-in customers to view order details belonging to guest customers (those who checked out without creating an account). As soon as we became aware of the issue, our team developed and deployed patches for all affected versions.

    Our investigation confirmed that this vulnerability:

    • Required a user to access a very specific API endpoint, and would not be discoverable without prior knowledge of the exploit.
    • Could only make information visible from guest customer orders.
    • Required a user to have a registered store account and be logged into the store.
    • Has existed for approximately two years with no known exploitation.

    What information may have been involved?

    If exploited, the vulnerability could have exposed guest customer order information, including names, email addresses, phone numbers, shipping and billing addresses, types of payment methods used, and items purchased. No credit card or other financial details would have been exposed. 

    Upon discovering the vulnerability, the Woo team immediately developed patches for all 23 affected WooCommerce versions (8.1 through 10.4.2) and carried out testing to ensure the patches would resolve the issue without disrupting store functionality.

    If you have any questions or concerns, simply respond to this email or click here, and someone from the Woo Happiness team will get back to you.

    Thank you, 
    The Woo Team

    Plugin Support shahzeen(woo-hc)

    (@shahzeenfarooq)

    1 month, 3 weeks ago

    Hi there!

    Thank you for bringing this to our attention. Before I escalate this issue, I’d like to confirm whether WooCommerce was the only plugin that was updated manually, or if any other plugins were updated at the same time.

    Also, is there any plugin currently active on your site that is showing an update notice?

    Plugin Author Nadir Seghir

    (@senadir)

    1 month, 3 weeks ago

    Hey @ronbi13, we asked the WordPress.org plugins team to trigger a forced patch update to all Woo stores; we almost never do that unless it’s a security risk, in which case, we created patches for all affected Woo versions (24 versions) that contain only the security fix. Your website, functionally speaking, and code-wise, is still 99% the same, minor the security fix.

    Also such auto update should only target WooCommerce, not any other plugins or WordPress core, if you see such behavior, please let me know, and I can double check with the WordPress.org plugins team.

    • This reply was modified 1 month, 3 weeks ago by Nadir Seghir.
    Moderator Samuel Wood (Otto)

    (@otto42)

    WordPress.org Admin

    1 month, 3 weeks ago

     I have a ban on automatic updates of all plugins.

    If you simply have automatic updates turned off in WordPress, then that is not actually the default setting.

    The default setting in WordPress is to have WordPress following what the update system at wordpress.org tells it to do, which is to install security updates automatically. This behavior only applies to security-only updates.

    If you disable auto updates in some other way, by like setting the relevant defines in wp-config or anything like that, then your setting would be respected by WordPress and it will not auto update regardless.

    However, note that some hosting systems, when warned about security updates, will update your plugins for you. Depending on the hosting system, this can bypass everything WordPress does and you can still receive an auto-update regardless.

    Thread Starter ronbi13

    (@ronbi13)

    1 month, 3 weeks ago

    Well, thank you. If this automatic update was initiated by you for the security of the site owners, then there is no problem.

    Plugin Support Frank Remmy (woo-hc)

    (@frankremmy)

    1 month, 3 weeks ago

    Hi @ronbi13,

    Thanks so much for the confirmation. I’m really glad to hear there’s no further concern on your end.

    Since everything is now clear, I’ll go ahead and close this thread. If you ever run into anything else or simply have questions, feel free to open a new topic anytime — we’re always here to help.

    If you have a moment, we’d truly appreciate a quick review about your experience with WooCommerce. Your feedback helps us improve and support more store owners around the world: https://wordpress.org/support/plugin/woocommerce/reviews/

    Wishing you a smooth and secure rest of your day!

    Plugin Author Nadir Seghir

    (@senadir)

    1 month, 3 weeks ago

    Only 10.4.3 had 4 fixes (3 were already slotted before we started working on the security issue), other releases only had one extra changelog.

    The fix is mentioned there:

    * Fix – Ensure guest orders cannot be read by customers without providing the key and billing address. [#62557](https://github.com/woocommerce/woocommerce/pull/62557)

    etaf

    (@etaf)

    1 month, 3 weeks ago

    i posted the same question as did not see this – i do a lot of prework and testing when certain plugins due for an update – and for this to be forced just before xmas and with the site owner away, this may have caused issues with orders expected over the christmas period, and conflict with a lot of other plugins i use in conjunction with woocommerce , i feel notification should have gone OUT – i also took the tome to view the changes planned when it was offered as an update available – and THST should also have had some sort of notification that an UPDATE will be forced

    i appreciate that plugin is free and offers great eccommecre – JUST would have been a huge inconvenance at this time of year with LOST orders had it not updated without error

    Moses M. (woo-hc)

    (@mosesmedh)

    1 month, 3 weeks ago

    Hi @etaf,

    Thank you for reaching out. I completely understand your concerns, and they’re absolutely valid. Plugin updates can sometimes conflict with existing plugins, which is why many developers prefer to review compatibility before applying updates. Having an automatic update occur without prior notice can understandably be worrying, and things could have gone differently.

    I’m glad to hear that everything is working fine now. As mentioned by the development team, the patch does not impact WooCommerce core functionality and was released to address a security vulnerability, which was considered critical.

    I truly appreciate you sharing your perspective. Your concerns and suggestions are entirely reasonable. Please feel free to let me know if you have any further questions or if you need additional clarification.

Viewing 13 replies - 1 through 13 (of 13 total)

You must be logged in to reply to this topic.

Tags