---
title: "WEB-CMS-008 WordPress Automatic Updates Disabled"
canonical: https://openvapt.com/checks/WEB-CMS-008.html
html: https://openvapt.com/checks/WEB-CMS-008.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-CMS-008 WordPress Automatic Updates Disabled

Checks whether wp-config.php turns off WordPress background updates, including security releases.

- Domain: Web Apps
- Severity: Medium
- Control category: Patch and Vulnerability Management
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 7.4
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104
- OWASP Top 10 2021: A06:2021
- OWASP ASVS 4.0.3: 14.2.1
- NIST SP 800-53 Rev. 5: SI-2

## Why It Matters

WordPress ships security fixes as automatic minor updates. Turning the updater off means the site stays vulnerable until someone remembers to update by hand, which is how most compromised WordPress sites fall behind.

## How It Detects

Reads each wp-config.php found through the web roots and fails when AUTOMATIC_UPDATER_DISABLED is true or WP_AUTO_UPDATE_CORE is false.

## How to Fix

Remove those lines, or set define('WP_AUTO_UPDATE_CORE', 'minor'); so at least security releases install automatically. Keep backups and enable plugin auto-updates where practical.

## How to Verify

```
Dashboard, Updates shows that automatic updates for maintenance and security releases are on.
```

## Learn the Theory

- [P6 Information Exposure and Misconfiguration](https://openvapt.com/academy/p6.md)
- [P14 CMS Hardening in Depth: WordPress, Joomla and Drupal](https://openvapt.com/academy/p14.md)

## References

- [WordPress Developer Resources, Configuring Automatic Background Updates](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/#configuring-automatic-background-updates)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/cms_more.go

Run it: `openvapt scan --only WEB-CMS-008`. Read it offline: `openvapt explain WEB-CMS-008`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-CMS-008.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.