Fix: warn on potentially misspelled parameters in wp user update by ikamal7 · Pull Request #624 · wp-cli/entity-command · GitHub

Description

When a typo'd flag like --user-pass is used instead of --user_pass in wp user update, the command now emits a warning with a suggestion instead of silently accepting the unknown parameter.

Fixes #5286

Approach

Added a check in User_Command::update() that compares unknown parameters against known user fields using Utils\\get_suggestion(). If a close match (Levenshtein distance ≤ 2) is found, a warning is emitted and the unknown parameter is removed before passing to wp_update_user().

Custom user meta fields that don't closely match known fields are still silently accepted for backward compatibility.

Testing

wp user update 2 --user-pass=newpass → Warning: unknown --user-pass parameter (did you mean '--user_pass'?)
wp user update 2 --user_pass=newpass → Success: Updated user 2. (unchanged)
wp user update 2 --some_custom_field=value → Success (no warning, BC preserved)

Summary by CodeRabbit

New Features
- Added warnings for likely misspelled parameters when updating users.
- Suggested corrections are provided for unrecognized user field options.
Bug Fixes
- Prevented unknown or misspelled parameters from being passed through during user updates.

When a typo'd flag like --user-pass is used instead of --user_pass, the command now emits a warning with a suggestion instead of silently ignoring the parameter. Fixes #5286

Hello! 👋

Thanks for opening this pull request! Please check out our contributing guidelines. We appreciate you taking the initiative to contribute to this project.

Contributing isn't limited to just code. We encourage you to contribute in the way that best fits your abilities, by writing tutorials, giving a demo at your local meetup, helping other users with their support questions, or revising our documentation.

Here are some useful Composer commands to get you started:

composer install: Install dependencies.
composer test: Run the full test suite.
composer phpcs: Check for code style violations.
composer phpcbf: Automatically fix code style violations.
composer phpunit: Run unit tests.
composer behat: Run behavior-driven tests.

To run a single Behat test, you can use the following command:

# Run all tests in a single file
composer behat features/some-feature.feature

# Run only a specific scenario (where 123 is the line number of the "Scenario:" title)
composer behat features/some-feature.feature:123

You can find a list of all available Behat steps in our handbook.

📝 Walkthrough

Walkthrough

User_Command::update() now recognizes whitelisted user fields and command flags, detects unknown parameters, suggests close field-name matches, warns about them, and removes them before updating the user.

Changes

User parameter validation

Layer / File(s)	Summary
Parameter whitelists and validation src/User_Command.php	Adds KNOWN_USER_FIELDS and COMMAND_FLAGS, then validates update arguments, warns on suggested matches, and removes unknown parameters before processing.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: warning on potentially misspelled parameters in wp user update.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 🧪 Generate unit tests (beta)

Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/User_Command.php`:
- Around line 45-65: Update the KNOWN_USER_FIELDS whitelist to include the valid
WordPress user fields user_activation_key and spam, preserving the existing
field entries and ordering style.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info ⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cbd34f7-9a2c-406a-8e2c-97f01f72e487

📥 Commits

Reviewing files that changed from the base of the PR and between 6c2cd2c and 36950f3.

📒 Files selected for processing (1)

src/User_Command.php

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

rg -n "'(user_activation_key|spam)'" src/User_Command.php
curl -fsSL https://developer.wordpress.org/reference/functions/wp_insert_user/ | grep -E "user_activation_key|spam"

Repository: wp-cli/entity-command

Length of output: 4577

🏁 Script executed:

sed -n '1,140p' src/User_Command.php

Repository: wp-cli/entity-command

Length of output: 3220

🏁 Script executed:

rg -n "KNOWN_USER_FIELDS|KNOWN_USER_FLAGS|suggest|close-match|user_activation_key|spam" src/User_Command.php

Repository: wp-cli/entity-command

Length of output: 1593

🏁 Script executed:

sed -n '620,650p' src/User_Command.php

Repository: wp-cli/entity-command

Length of output: 1060

Keep KNOWN_USER_FIELDS aligned with WordPress.

user_activation_key and spam are valid wp_update_user() fields, but they’re missing from this whitelist. That means --user_activation_key and --spam can be treated as unknown instead of passing through cleanly.

Suggested fix

 		'user_registered',
+		'user_activation_key',
+		'spam',
 		'locale',

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

      
            	const KNOWN_USER_FIELDS = [
          
            		'user_pass',
          
            		'user_nicename',
          
            		'user_url',
          
            		'user_email',
          
            		'display_name',
          
            		'nickname',
          
            		'first_name',
          
            		'last_name',
          
            		'description',
          
            		'rich_editing',
          
            		'syntax_highlighting',
          
            		'comment_shortcuts',
          
            		'admin_color',
          
            		'use_ssl',
          
            		'show_admin_bar_front',
          
            		'user_registered',
          
            		'locale',
          
            		'role',
          
            		'meta_input',
          
            	];
          
            	const KNOWN_USER_FIELDS = [
          
            		'user_pass',
          
            		'user_nicename',
          
            		'user_url',
          
            		'user_email',
          
            		'display_name',
          
            		'nickname',
          
            		'first_name',
          
            		'last_name',
          
            		'description',
          
            		'rich_editing',
          
            		'syntax_highlighting',
          
            		'comment_shortcuts',
          
            		'admin_color',
          
            		'use_ssl',
          
            		'show_admin_bar_front',
          
            		'user_registered',
          
            		'user_activation_key',
          
            		'spam',
          
            		'locale',
          
            		'role',
          
            		'meta_input',
          
            	];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/User_Command.php` around lines 45 - 65, Update the KNOWN_USER_FIELDS
whitelist to include the valid WordPress user fields user_activation_key and
spam, preserving the existing field entries and ordering style.

Thanjs for your PR!

Please see discussions at #528 and wp-cli/wp-cli#5286 on possible approaches.

We need a solution that works for all entities, not just users, and can be updated witz new core repeases.

Codecov Report

❌ Patch coverage is 35.71429% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/User_Command.php	35.71%	9 Missing ⚠️

📢 Thoughts on this report? Let us know!

Thanks for the feedback @swissspidy!

I read through the discussion on #528 and understand the concerns. A few thoughts/questions:

Cross-entity approach — I agree a uniform solution is ideal. Would the preferred direction be to:
- A) Remove --<field>=<value> from each entity command's docblock and complete the field list (as mrsdizzie suggested)? This gives us free validation from the framework but loses support for custom meta fields.
- B) Build a shared entity field registry (as you originally suggested on #5286) that could live in the framework and be referenced by all commands?
- C) Something else?
Custom fields — For wp_update_user() / wp_update_post() / wp_update_comment(), plugins can add custom meta via filters like wp_pre_insert_user_data or meta_input. If we remove --<field>=<value>, those would break. Is that a concern, or is that considered out of scope?
Next steps — I'm happy to either adapt this PR to whichever approach the team prefers, or help scope out a broader solution. What would be most useful?

Breaking existing functionality is usually not desireable.

I recommend continuing the discussion at wp-cli/wp-cli#5286 before jumping straight into code. Maybe there are other options too.

Closing this one for now in favor of discussion at wp-cli/wp-cli#5286

Fix: warn on potentially misspelled parameters in wp user update

36950f3

When a typo'd flag like --user-pass is used instead of --user_pass, the command now emits a warning with a suggestion instead of silently ignoring the parameter. Fixes #5286

ikamal7 requested a review from a team as a code owner July 22, 2026 18:18

github-actions Bot added bug command:ability labels Jul 22, 2026

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

ikamal7 mentioned this pull request Jul 23, 2026

wp user update silently ignores typo'ed --user_pass flag wp-cli/wp-cli#5286

Open

swissspidy closed this Aug 6, 2026

coderabbitai Bot mentioned this pull request Aug 16, 2026

Document all accepted fields for the catch-all write commands #636

Merged

Fix: warn on potentially misspelled parameters in wp user update by ikamal7 · Pull Request #624 · wp-cli/entity-command · GitHub

Uh oh!

Fix: warn on potentially misspelled parameters in wp user update - #624

Fix: warn on potentially misspelled parameters in wp user update#624
ikamal7 wants to merge 1 commit into
wp-cli:mainfrom
ikamal7:fix/5286-warn-unknown-user-update-flags

ikamal7 commented Jul 22, 2026 •
edited by coderabbitai Bot
Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 •
edited
Loading

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jul 22, 2026

Uh oh!

swissspidy commented Jul 22, 2026

Uh oh!

codecov Bot commented Jul 22, 2026

Uh oh!

ikamal7 commented Jul 23, 2026

Uh oh!

swissspidy commented Jul 23, 2026

Uh oh!

swissspidy commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Fix: warn on potentially misspelled parameters in wp user update by ikamal7 · Pull Request #624 · wp-cli/entity-command · GitHub

Uh oh!

Fix: warn on potentially misspelled parameters in wp user update - #624

Fix: warn on potentially misspelled parameters in wp user update#624ikamal7 wants to merge 1 commit intowp-cli:mainwp-cli/entity-command:mainfrom ikamal7:fix/5286-warn-unknown-user-update-flagsikamal7/entity-command:fix/5286-warn-unknown-user-update-flagsCopy head branch name to clipboard

Conversation

ikamal7 commented Jul 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Approach

Testing

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

coderabbitai Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

swissspidy commented Jul 22, 2026

Uh oh!

codecov Bot commented Jul 22, 2026

Codecov Report

Uh oh!

ikamal7 commented Jul 23, 2026

Uh oh!

swissspidy commented Jul 23, 2026

Uh oh!

swissspidy commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Fix: warn on potentially misspelled parameters in wp user update#624
ikamal7 wants to merge 1 commit into
wp-cli:mainfrom
ikamal7:fix/5286-warn-unknown-user-update-flags

ikamal7 commented Jul 22, 2026 •
edited by coderabbitai Bot
Loading

coderabbitai Bot commented Jul 22, 2026 •
edited
Loading