I just found this in the Codex: http://codex.wordpress.org/Configuring_Automatic_Background_Updates#Core_Updates.
Core updates are subdivided into three types:
1. Core development updates, known as the “bleeding edge”
2. Minor core updates, such as maintenance and security releases
3. Major core release updates
By default, every site has automatic updates enabled for minor core releases and translation files. Sites already running a development version also have automatic updates to further development versions enabled by default.
So, you there should not be auto core updates for major versions.
Also, like you said, you are not the only one who appears to be having this problem. I just found this post http://wordpress.stackexchange.com/questions/172689/why-is-wordpress-4-1-an-auto-update.
Have you checked to see if there is a code in your wp-config.php or any other file that would enable it?
Correct, and that was my understanding until I awoke this morning to find OSSEC alerting me to a handful of core files being changed. Logged in to find that my site had been updated to 4.1. Unless I’m sleep walking there has to be some reason so thought I’d open a thread to see if others have experienced this.
That post is exactly the post I was referencing, seems like they’re asking the same question but so far that’s the only other report I’ve found.
Also, to answer your question – I did check wp-config just to see if I’d enabled it for some reason in the past but no luck. I intend to dig deeper when I have time today but as of right now I don’t remember enabling anything intentionally.
Thanks for your feedback.
Unless I’m sleep walking…
It is most likely just an error in WordPress, or in one of your plugins or themes.
If you don’t want to have it auto update, you can just put the following code into your wp-config.
define( 'AUTOMATIC_UPDATER_DISABLED', TRUE );
define( 'WP_AUTO_UPDATE_CORE', FALSE );
Or, you can just us Disable Updates Manager.
@jeremyjaymes – I believe some hosts do auto-updates so you may want to check on that end of it.
@matthew – I’d prefer not to disable core updates. I’d like it to run minor releases as usual but want to maintain control of major. I’m guessing that you are correct it is probably due to a plugin although I don’t run many. Less likely but possibly due to something I’ve added to my theme and just don’t remember. My goal here is to see if anyone else has seen this happen so maybe we can compare plugins or something.
@wpyogi – good suggestion, unfortunately I’m not on a managed host, unmanaged VPS.
I’m open to any other ideas, really appreciate how quickly you both jumped on this ticket.
Unless configured via plugin or wp-config.php, WordPress will not update to a major point releases, like 4.1.
With that said though, some hosting providers do force the update for all customers.
(Which I realize has already been stated above, just re-stating for the sake of context and confirmation.)
There are more ways for something like a plugin to enable auto-updates than just WP_AUTO_UPDATE_CORE. There are filters for example. Look for anything using the allow_major_auto_core_updates filter, or any filter name starting with auto_update_.
Ultimately, it’s not the API call actually doing the update. That just returns the version and info about it. The current version you have performs the update, and determines whether or not to perform that update.
Additionally, you state this:
until I awoke this morning to find OSSEC alerting me to a handful of core files being changed
Did you actually get the WordPress auto-update email too? It will be the one with a subject of “Your site has updated to WordPress X.X”. If you didn’t get that email, then either a) something is suppressing or blocking it, or b) WordPress didn’t actually do the update and some other system did. Again, even some non-managed hosts have the ability to update WP for you. Ask them.
Good advice, I’ll take a further look at the few plugins I have running to see what I can find. I do have BruteProtect running and I’m starting to wonder if I might have set something there.
To answer your question, I did not receive the auto-update email, that’s part of the reason I posted here. I assumed right away that it was something other than core (probably should have stated that) and was hoping to see if anyone else experienced the same thing, perhaps helping me to narrow it down.
Regarding hosting, have a few other installs running on the same machine that did not auto-update. To my knowledge Linode is pretty hands off on that type of thing, they pretty much put you in the drivers seat.
Just to be clear, I do not or did not consider this to be some sort of a bug, I’m sure I’ll find that it’s self-inflicted. To be totally honest I’m starting to wonder if perhaps I ran the update myself in some sort of a sleepy haze before I signed off for the evening.
It’s a mystery. Good news is that the update itself caused no issue.
Thanks to everyone that added their comments to this thread, I’ll go ahead and mark it resolved for now. If I find the culprit I’ll post back.
