WP-CLI Command

Ability Auditor registers one WP-CLI command, available as soon as the plugin is active on a WordPress 6.9+ site.

wp ability-audit run [--format=<format>] [--fail-on=<severity>] [--[no-]save]

Options#

Option	Values	Default	What it does
--format	table, json, csv	table	table prints a summary line and the findings. json prints the full audit. csv prints one row per finding.
--fail-on	critical, high, medium, low, info	none	Exit with status 1 when a finding at or above this severity exists.
--save / --no-save		--save	Store the audit in History (trigger WP-CLI). Use --no-save for throwaway runs.

Table output#

$ wp ability-audit run
Audited 14 abilities in 0.42s: 0 critical, 3 high, 2 medium, 5 low, 6 info.
+----------+-----+-----------------------------+---------------------+--------------------------------------------+
| severity | new | ability                     | rule                | message                                    |
+----------+-----+-----------------------------+---------------------+--------------------------------------------+
| high     | new | woocommerce/product-delete  | destructive-exposed | Annotated destructive and exposed to: REST |
| ...      |     |                             |                     |                                            |
+----------+-----+-----------------------------+---------------------+--------------------------------------------+

The new column is filled in when the audit is saved and there is a previous audit to compare with. If nothing was found, the command prints “Success: No findings.”

JSON and CSV output#

Both keep standard output clean so you can pipe or redirect it:

# Save the full audit as JSON.
wp ability-audit run --format=json > audit.json

# Findings as CSV, without storing the run in History.
wp ability-audit run --format=csv --no-save > findings.csv

The content matches the dashboard exports exactly; see Exports.

Warnings#

If a permission callback tried to run an ability during the audit, the command prints a warning naming the abilities. The attempts were blocked.

Multisite#

Run the command against a specific site with WP-CLI’s --url flag, for example wp ability-audit run --url=shop.example.com. Each site has its own history.