I'm trying out adding WordPress REST API endpoints. I would now like to add an endpoint that retrieves a list of available plugin, theme and core updates.

I found the following functions: get_plugin_updates(), get_theme_updates() and get_core_updates(). With these functions I could retrieve info about which plugins to update.

How do I start the update proces for a plugin/theme/core? I'm especially looking for updating an individual item. Similar to WP Manage and GoDaddy Hub.

It would be great if someone could tell me how to implement this and how to start the update process!

1 Answer 1


REST or anything RESTful is a generally adhered to standard of getting things done via API. It also has the capability of documenting itself.

Now I had expected to write an answer here about how it's not a great idea to allow endpoints to update or modify any of your codebase but I see it seems the good folks at Automattic have thought it ok and they know the core a lot better than I do, I also presume you need to be authenticated before using it.

Go to [yourwordpresswebsite.com]/wp-json/

It brings up a sort of library of endpoints and how to use them

If you go to routes then find "/wp/v2/plugins/(?P<plugin>[^.\/]+(?:\/[^.\/]+)?)" and endpoints

You can see the following

    0   "GET"
        args    {…}
        0   "POST"
        1   "PUT"
        2   "PATCH"
        args    {…}
        0   "DELETE"

Which you can match up in the REST API docs on plugins

This sort of updating via API should IMO only be done for ease of something like mass-rollout. Say you have a hundred servers running the same core setup and your testing has concluded it's safe.

You can also just set up WordPress to update itself automatically instead and save yourself the bother.

There are some interesting examples of using composer to install / update WordPress. Look at johnpbloch, satispress. Also off the shelf Wordfence Central

  • Hey Bysander, thanks for your help! I tried it, but it says that I don't have access to manage plugins. I think that I can fix it with this answer, but then I still don't have a way to run theme and core updates.... And for those there isn't an endpoint...
    – ralphjsmit
    Mar 24, 2021 at 8:01
  • Looking at the links off that page the issue is to do with what I touched on above - authentication. WP provide the endpoints, but the user must be authenticated to use them. As the only current way to authenticate natively in WP is via cookie you will either have to include that in your Curl request (not a solution) or bolt on another layer of authentication. I have worked with this plugin or at least one of it's ancestors before - but this was in the days before WP even had a native REST service.
    – Bysander
    Mar 24, 2021 at 9:58
  • Once you have authentication cracked - then all you will need to do is add an endpoint and run the code. See codex
    – Bysander
    Mar 24, 2021 at 10:00
  • Allright. Say that I have fixed authentication and created an endpoint – what code do I need to run for theme or core updates?
    – ralphjsmit
    Mar 24, 2021 at 10:53
  • So you wouldn't run code for the plugins - you can hit those authenticated end points - for example /wp/v2/plugins/plugin_name. Regarding updating wordpress I wouldn't know off the top of my head and haven't done it before. Looking at some of the update hooks led me here - which seems like a good start.
    – Bysander
    Mar 24, 2021 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.