Is it possible to use WP-CLI in a plugin (or theme)?

WP-CLI is a command line interface to WP. So, it is used in a Unix shell environment. Plugins and themes are written in PHP (which itself also runs in a shell, usually Unix). So, to execute a WP-CLI command in a plugin you would have to pass it from PHP to the Unix shell. That may be done using the PHP function shell_exec.

So, the answer to the question ‘is it possible?’, is YES. However, the answer to the question ‘should I be doing this?’ is NO WAY. Here are some considerations:

  1. WP-CLI may not even be installed on the server the plugin/theme is used on, for instance because it is a Windows based server.

  2. Using shell_exec from a theme/plugin is a security risk, because of the powerful commands that are possible on the command line. Many providers block PHP from using shell_exec and other execution commands.

  3. Everything you can do through WP-CLI can be done in WP proper as well. After all, it is a gateway to WP and offers no additional functionality.

Related Posts:

  1. How to store username and password to API in wordpress option DB?
  2. In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
  3. How to properly validate data from $_GET or $_REQUEST using WordPress functions?
  4. Nonces can be reused multiple times? Bug / Security issue?
  5. Can someone explain what wp_session_tokens are, and what are they used for?
  6. WordPress and PHP Sessions – Security and Performance
  7. What is the difference between esc_html and wp_filter_nohtml_kses?
  8. Nonce in settings API with tabbed navigation
  9. Log in from one wordpress website to another wordpress website
  10. Escaping built-in WP function return strings
  11. What is the difference between strip_tags and wp_filter_nohtml_kses?
  12. WP Cron doesn’t save or in post body
  13. Unable to write test cases for a WordPress plugin using PHPUnit and WP-CLI
  14. Install and load additional plugins when running unit tests
  15. WordPress restrict plugin file direct access
  16. How Can I setup WP CLI on Windows development machine running AMPPS?
  17. Plugin development: is adding empty index.php files necessary?
  18. DataBase connection problem with PHPUnit and WordPress
  19. Confusion on WP Nonce usage in my Plugin
  20. Coding a plugin on WordPress; when should I sanitize? [duplicate]
  21. Correct way check nonce (security) using old Options API
  22. Why do I need to check if wp_nonce_field() exists before using it
  23. Is there any way to check for user login and send him to login?
  24. WordPress security issue to output data from user input from theme option form
  25. Verify if user is wordpress logged in from another app since wordpress 4.0
  26. Secure Pages Best Practice
  27. Securing/Escaping Output of file content – reading via fread() in PHP
  28. best way to make a WordPresss multisite that is secure but at the same time supporting my plugin development efforts
  29. Video Security just like facebook [closed]
  30. Is disabling test_form in wp_handle_upload a security concern?
  31. How to connect my wordpress plugin to a remote database securely?
  32. wp_nonce_field displaying twice
  33. Is it necessary to do validation again when retrieving data from database?
  34. Update custom plugin with WP-CLI
  35. adding wp-cli commands to plugin: how to document to users?
  36. Checking a WordPress for OWASP top 10 vulnerabilities [closed]
  37. How do I have now a duplicated user entry if this is not allowed (and I cannot replicate it)?
  38. add_submenu_page hooked function must explicitly check user capabilities – why?
  39. Are there any security risks when submitting data-attribute data through AJAX?
  40. Why would you use esc_attr() on internal functions?
  41. Secruity Questions on a timer
  42. Using HTML links within translatable string
  43. How can I save a password securely as a settings field
  44. Using password protection to load different page elements?
  45. HTML Elements in my WP Plugin being generated in JS. Security and Translated Text Question about this method being used
  46. How to store sensitive user data (passwords)
  47. How do I make secure API calls from my WordPress plugin?
  48. esc_attr() on hard coded string
  49. how to add security questions on wp-registration page and validate it
  50. Experts opinions needed: How (in)secure is this approach?
  51. What is more secure checking capabilities of user or checking role of user in WordPress plugin development
  52. Data Validation, dynamically generated fields (select for example)
  53. esc_url, esc_url_raw or sanitize_url?
  54. Update Option Stored in Multi-Dimensional Array
  55. $wpdb->insert_id
  56. Remove profile picture option (and other things) from profile.php (in admin)
  57. How Can I Add a Filter to Class Instance Only?
  58. Getting old term value with edited_{$taxonomy} | Hook
  59. Call activation hook multiple times
  60. Adding custom code into header.php using a plugin
  61. Two-step login process – Is it possible?
  62. Unified Approach for Placing Option Pages
  63. Define a function outside a class and call the function using action or filter hook
  64. Modifying WordPress plugins
  65. On plugin deactivation hide its shortcode
  66. WordPress removing data attributes for scheduled post
  67. Verify Nonce returns false – Request Nonce returns correct value
  68. Can I change header.php of current theme through a plugin function?
  69. Writing a plugin which needs to upload files
  70. Calling is_single() outside the loop
  71. update woocommere total value on checkout based on selected payment method
  72. Add a Save Button to Custom Meta Box [duplicate]
  73. Gutenberg: import dependency or assign from global variable?
  74. Following WordPress Markup Is mandatory, got awkward resultyby wordpress standard markup?
  75. Steps to Update a WordPress Plugin That We Developed
  76. Using WAMP, trying to create a plugin, getting error: You do not have sufficient permissions to access this page
  77. Loading Modernizr (or other JavaScript libraries) for use in a plugin
  78. Issue on Setting $icon_url Parameter on WP add_menu_page()
  79. Logout after clicking URL link results in “headers already sent” error
  80. Save temporary registration data
  81. Activate / Deactivate plugin
  82. Serial Number from custom table not appear in woocommerce_email_before_order_table action
  83. Always hide a page from the menu
  84. Author Meta in Author URL Link
  85. get_comment_meta() for a filter hook in a plugin
  86. form does not generate $_POST request
  87. Callback function quicktags that uses variable in start tag
  88. Font Awesome stopped showing icons, shows &# text instead [closed]
  89. WordPress Plugin Tool Tip Helpers
  90. Can I use a hook other than ‘init’ to handle form submissions?
  91. Managing Custom Designed Content
  92. Stop theme displaying comments
  93. Plugin capabilities
  94. plugin will not offer update even though a new version is available
  95. How to filter manage categories listing
  96. How to remove a class [closed]
  97. how to catch a data from a array in WordPress
  98. External api call using wordpress
  99. Set link dialog to open in blank by default
  100. plugabble wp_authenticate function not works from wp-login.php