Weaver Xtreme apparent cause of failure of WordPress, plugins to update?

[slywy]

WordPress 6.0.3 came out, and several plugins were updated. My site kept telling me to “contact the site administrator” and that I don’t have access to core updates. Disabled plugins, looked at the config and some other files, couldn’t find the issue. Dave of tech support at Prohosting switched the them to Twenty Twenty Two, and that brought back the ability to update (and autoupdate). Switching back to Weaver Xtreme removes the ability to autoupdate plugins and WP (or to update them at all). Switching to one of the built-in WordPress themes brings back the ability to update.

Just wanted to see if anyone else had experienced this and if they have that this may help them fix it.

### Weaver System Info ###

— WordPress Configuration —

Site URL: https://www.slywy.com
Home URL: https://www.slywy.com
Multisite: No
Version: 6.1.1
Language: en_US
WP_DEBUG: Disabled
WP Memory Limit: 40M
Permalink: /%postname%/
Show On Front: posts
Page On Front: n/a
Page For Posts: n/a
Current Theme: Weaver Xtreme (5.0.7)
Post Types: post, page, attachment, revision, nav_menu_item, custom_css, customize_changeset, oembed_cache, user_request, wp_block, wp_template, wp_template_part, wp_global_styles, wp_navigation, jb_store_css, feedback, wpephpcompat_jobs, jp_mem_plan, wpforms, jp_pay_order, jp_pay_product

— Weaver Xtreme Configuration —

Weaver Xtreme Version: 5.0.7
Theme Support Version: 5.0.1

— Server Configuration —

Operating System: FreeBSD
PHP Version: 7.4.24
MySQL Version: 5.7.30
jQuery Version: 3.6.1
Server Software: Apache

— PHP Configuration —

Local Memory Limit: 256M
Server Memory Limit: 256M
Post Max Size: 101M
Upload Max Filesize: 100M
Time Limit: 900
Max Input Vars: 5000
Display Errors: On (1)

— WordPress Active Plugins —

Akismet Anti-Spam: 5.0.1
BackWPup: 4.0.0
Broken Link Checker: 1.11.21
Google Analytics for WordPress by MonsterInsights: 8.10.1
Jetpack: 11.5.1
Jetpack Boost: 1.5.4
Microsoft Clarity: 0.7.5
No Self Pings: 1.1.5
Photonic Gallery & Lightbox for Flickr, SmugMug, Google Photos & Others: 2.83
PHP Compatibility Checker: 1.5.2
Redirection: 5.3.5
Weaver Show Posts: 1.5.1
Weaver Xtreme Theme Support: 5.0.2
WP Force SSL: 1.65
WPForms Lite: 1.7.8
Yoast Duplicate Post: 4.5
Yoast SEO: 19.10

— WordPress Inactive Plugins –### End System Info ###

Site: https://www.slywy.com/

[Weaver]

I don’t know of any issues with Weaver Xtreme causing issues with updating.

Switching themes making it work seems very puzzling. There really isn’t anything Weaver can do or  does do that should break that.

One user had some issues with admin actions and Weaver which turned out to be caused by broken / lost files in the core WP installation. They did a complete re-install of a fresh copy of WP and that fixed the issue.

WP 6.1.1 is the latest version as of this reply, but the info dump you supplied indicates you have 6.1.1.

I am a bit suspicious of the WP Force SSL plugin as any modern host will provide the tools for https: configuration. That also requires having https:// included in your Settings -> Site Settings Site URL and WordPress URL values. But back a couple of years ago, the hosting configuration did not always include an SSL certificate, and most now do provide a certificate, thus should be no need for WP Force SSL.

[scrambler]

To eliminate a possible plugin interaction problem, it would be worth deactivating ALL non weaver plugins and see if the update then becomes possible. If it does reactivate one by one to find the culprit.

Also worth redoing the last installed WordPress update to refresh everything.

[GR8FL]

WordPress 6.1 was a painful process for driving critical errors on several sites and I think caught many plugin developers by surprise. It totally messed up a calendar plugin I was using until the plugin author could update it. It also messed with a backup plugin on another site. But I had no issues with Weaver.

Agree with @scrambler to deactivate all plugins and then one by one activate and then test until you find the culprit.

[slywy]

I thought I had done that but will try again when there’s an update. Both the host and I found we could update only when the Weaver Xtreme theme was deactivated but I could have missed something.

[slywy]

I had done this but did it again. I found the only thing that allows WP, themes, and plugins to be updated (or added) is to activate a theme that is not Weaver Xtreme. I have no idea why that is but that’s what’s happening. I updated to WP 6.1.1 by deactivating Weaver Xtreme, updating, then reactivating Weaver Xtreme.

[scrambler]

Look for traces of a hack.

If you do not have it installed, install the Wordfence Security plugin and run a scan.

Also check your plugin directory in your Cpanel file manager.
Someone recently found a rogue plugin installed in their plugin directory that did not appear on the list of installed plugin. It was hacking something in the weaver theme he was using, causing Admin issues with installation.

[slywy]

I found one weird file in the FTP manager plugin folder that was 0 bytes and had an unusual icon (not like the WP or other plugin icons). I deleted it, and the problem seems to be resolved. Will update in a few days if changes.

[scrambler]

Run a scan with Wordfence….

[Weaver]

PLEASE NOTE: WordFence is a free plugin that does a really good job at protecting your site. The file scan it does compares all files in the theme and plugin program directories to the current versions of WP and plugins. It has a small overhead, but if that worries you, just use it for a while, then you could disable it. But you can’t really count on yourself to find all rogue files that might have gotten into your directories.

I believe that some hacks install files specific to whatever theme you are using – so it isn’t necessarily related to Weaver or Astra or whatever theme you have at the moment. I’ve also seen hacks hidden in the mustuse plugin directory. Mustuse plugins do not normally show up in the plugin list, and are most often added by your hosting company to customize performance for that host, but is a spot to hide things.

[slywy]

I hadn’t had a chance with work, but just did and removed some files it identified as potentially malware, as well as some outdated WordPress files. One Weaver Xtreme file was also flagged. There’s one flagged outside WordPress I’ll have to ask the hosting company about.

[slywy]

Host removed the last questionable file as not theirs, so looks clean now. Thanks for the suggestion of Wordfence. I think I’d looked at it once but wasn’t sure it was okay. Now I know.

[Author]

Posts