I try to build a custom api route for resetting the password from a WordPress user. I build a custom route with a function and al the data passing in the function is correct but the function not executes end returns an error (the 500 error can't reset). I build this because I didn't want to send the user to the wp-admin. The WordPress user must have the ability to reset the password in the app I building and the reset must reset the password and send a mail with the new password.

Custom route:

register_rest_route( $namespace, '/' .  $base . '/reset', array(
               'methods'                => 'POST',
               'callback'               => array( $this, 'myplugin_reset_user_pass' ),


public function myplugin_reset_user_pass( $request ) {

        $params = $request->get_params();

        $userdata = array( 
            'user_email'    => $params['user_email']

        $user = get_user_by( 'email', $userdata['user_email'] );

        // check if username / email exist
        $username = username_exists( $user->user_login );
        if ( $username and email_exists($user->user_email) == true ) {
            if ( function_exists( 'wp_set_password')  ) {
                // generate new password

                $password = wp_generate_password( 8, true );
                $resetPass = wp_set_password( $password, $user->id );

                    return new WP_REST_Response(true, 200);
        return new WP_Error( 'cant-reset', __( 'message', 'text-domain'), array( 'status' => 500 ) );
  • $request->get_params(); if check values get Commented Jan 9, 2018 at 8:53
  • getting the values is not a problem the function wp_set_password not run succesfull, but print_r gives the generated pass and the user id is also correct. Is authentication needed for this function? Commented Jan 9, 2018 at 10:41
  • 1
    the function wp_set_password doesn't return a value then $resetPass is always NULL
    – mmm
    Commented Jan 9, 2018 at 13:47
  • That explains why it doen't return the 200 response. How can i check if the function succesfull changes the password? Commented Jan 10, 2018 at 9:05

1 Answer 1


wp_set_password does not appear to do anything (at least in my testing) but instead calling wp_update_user does the trick:

$update_password = wp_update_user(array(
  'ID' => get_current_user_id(),
  'user_pass' => $data['newPassword']

It will hash the plaintext password you give to it, and trigger any email notifications about the password changing.

Then you can see if it worked by doing this:

if (is_wp_error( $update_password )) {
  // it did not work :(
  // it worked!

Hope this helps someone!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.