Does a user need to be logged in for plugins, or core to update?
No, a cron job is a cron job, there is no current user or active user in a cron job, so there is no logged in user either. So no, they do not. Cron jobs don’t run on user requests.
For example, if you call wp_get_current_user in a cron job, the user returned has the ID 0, because there is no current user.
Even if you are logged in, that’s a totally separate request from a cron job, it has no effect.
Am I wrong, does wp-cron require admin files before a task is run?
If your cron job uses functions that are only available in a WP Admin context then yes. Otherwise no. I do not know which applies to you as you have shared no code.
But you can test if this is the case easily by running the cron job and checking the result. Your PHP error log will show fatal errors if you need the admin files but haven’t included them.
However.
- WordPress added self-updating functionality and plugin automatic updates behind the scenes in v5.5, you’re building functionality that already exists, just change the timing on the WP Cron job that already exists
- WordPress already emails the admin email when updates happen too
- It’s unwise to use the same server for backups as the server you’re backing up
- WP CLI would run in a similar context, and you can list and trigger cron events with WP CLI for testing
For example, you could disable all automatic updates, then add a system level cron job that runs these commands:
wp db export backup.sql
wp core update
wp plugin update --all
You could even set up a system cron job to trigger WordPress’ cron job system, providing reliability, and speeding up your site.
wp cron event run --due-now
If you still wanted to use a totally bespoke cron job, you can trigger it with:
wp cron event run yourcronhook