WordPress Multisite 5.5.3 All Plugins set have Auto-Updates Disabled, but they Updated themselves anyway

[wellesleyps]

Running a WordPress Multisite Installation on Version 5.5.3 at the time of the issue.
All plugins have Auto-Updates DISABLED (I like to run them only when I have time available to troubleshoot in case something goes wrong.)
However, on December 14, 2020 (coincidentally at the same time as the big Google outage) - All 14 of my plugins that had updates available automatically updated themselves, even though I had all auto-updates disabled. This caused my site to get overloaded and go down, which was a big issue since google was also down and made it hard to communicate.

I have since updated to WordPress 5.6, and run other updates manually (core and themes), but I cannot figure out why the plugins auto-updated themselves. I suspect it could be a multisite issue. Some plugins are network activated and others are only activated on one site. The core and themes did NOT auto-update only the plugins updated themselves.

I am very nervous that it could happen again and cause downtime. I need to be able to plan ahead and control the update timing to occur on a slow time of day. Not sure if others with multisite installations have experienced the same.

Thanks!

[nikunj8866]

Reproduction Report

❌ This report validates that the issue cannot be reproduced on the latest environment(6.8.2).

Environment

• WordPress: 6.8.2
• PHP: 8.4.10
• Server: nginx/1.26.1
• Database: mysqli (Server: 8.0.35 / Client: mysqlnd 8.4.10)
• Browser: Chrome 139.0.0.0
• OS: Windows 10/11
• Theme: Twenty Twenty-Five 1.3
• MU Plugins: None activated
• Plugins:
  • Classic Editor 1.6
  • Hello Dolly 1.6
  • Test Reports 1.2.0
  • WP Crontrol 1.18.0
  • WPGetAPI 2.2.10

Steps

1. Create a fresh WordPress Multisite installation.
2. Install several plugins with older versions (so updates are available).
3. Activate some plugins network-wide, and others only on specific sub-sites.
4. Install and activate ​https://wordpress.org/plugins/wp-crontrol/ plugin to manually run cron event.
5. Disable auto-updates for all plugins.
6. Trigger the cron event wp_version_check from Tools > Cron Events(​https://prnt.sc/0Z6RhYCCNWcY).

Test Cases

Case 1: Auto-Updates Disabled for All Plugins

• Disabled auto-updates for all installed plugins.
• Ran the cron event wp_version_check.
• ✅ No plugins were auto-updated.

Case 2: Auto-Updates Enabled for Specific Plugins

• Enabled auto-updates for some plugins, while keeping others disabled.
• Ran the cron event wp_version_check.
• ✅ Only the plugins with auto-updates enabled were updated.
• ✅ Disabled plugins were not updated.

Actual Results

• ❌ The issue described in the original ticket cannot be reproduced.
• Auto-updates behave as expected in WordPress 6.8.2.

Additional Notes

• I also tested this scenario on WordPress 5.5.3 (the version from the original report) and was still unable to reproduce the issue. All auto-update behaviors matched expectations.
• This suggests the reported behavior might have been caused by a site-specific conflict (e.g., a custom plugin, or hosting-level cron job interfering with updates).