Plugin/Theme Auto-Update

Alert ID: plugin_update · theme_update

---

Severity / Criticality

Level	Condition
Info	A plugin or theme is updated, either by the WordPress automatic updater or manually from the site itself

Note

These events are always emitted with Info severity. They do not indicate malicious activity by themselves: their purpose is change traceability.

---

Why does it matter?

• Change traceability: every version change on the site is recorded in the panel, with the old and new version.
• Post-update review: updates can break functionality or change site behavior; the event tells you exactly when and what changed.
• Correlation: an update event near the time of an incident helps distinguish a legitimate version change from suspicious activity reported by plugin_changes or theme_changes.
• Inventory accuracy: after each event the plugin triggers an inventory sync so the panel reflects the new version.

---

When does the alert trigger?

• Automatic update completed: the WordPress automatic updater finishes updating a plugin or theme (automatic_updates_complete hook). Only updates that completed successfully generate an event.
• Manual update completed: an update started from the site itself, for example the WordPress admin or WP-CLI (upgrader_process_complete hook with action=update). Only real upgrades fire the event; downgrades and reinstalls of the same version are skipped.
• Version capture: the previous version is captured just before WordPress replaces the files; if it cannot be determined it is reported as unknown.
• Deduplication: automatic updates emit at most one event per component and day; manual updates deduplicate per minute.

Note

When the site is paired with the panel, the plugin takes control of WordPress native auto-updates for plugins and themes so that updates can be managed from the panel, and individual components can be excluded from automatic updating.

---

Event data

Field	Description
component_type	plugin or theme
component_name	Human-readable name of the updated component
component_slug	Plugin or theme slug
version_old	Version before the update, or unknown
version_new	Version after the update
update_mode	automatic or manual
triggered_by	Origin of the update, for example wp_auto_updater for automatic updates

---

Common false positives

• This alert is informational, so there are no false positives in the malicious sense: every event corresponds to a real version change.
• Frequent events are normal on sites with WordPress auto-updates enabled or with active maintenance.

Caution

An update event that nobody on the team recognizes deserves review: confirm who or what triggered it using the update_mode and triggered_by fields.

---

Investigation steps

1. Check the event details: component, version_old → version_new, and update_mode.
2. Review the changelog of the new version on the official plugin or theme page.
3. Verify that the site works normally after the update: frontend, admin, and critical flows.
4. If the update was manual and unexpected, confirm which administrator or tool performed it.
5. Correlate with other alerts around the same time, such as plugin_changes, theme_changes, or login activity.

---

Recommended mitigations

Immediate

Tip

• Verify that the site works correctly after the update.
• Review the changelog of the new version.
• If the update causes problems, revert to the previous version from a backup.

Preventive

Note

• Keep regular backups so any problematic update can be reverted quickly.
• Review these events periodically to keep a clear picture of version changes on each site.

---

References

• WordPress Auto-updates documentation
• WordPress Plugin and Theme Update Guides