WordPress.org

Like the rest of WordPress, the XML-RPC API contains numerous hooks to customize or extend its behavior.

Actions

All built-in XML-RPC methods use the action xmlrpc_call, with a parameter equal to the method's name (e.g., wp.newPost). The action is performed after the user has been authenticated but before the rest of the method logic begins.

xmlrpc_methods Filter

The xmlrpc_methods filter allows for customization of the methods exposed by the XML-RPC server. It can be used to both add new methods and remove built-in methods.

Add Simple Method

Here is an example of adding a simple method that does not require user authentication or input sanitation:

function mynamespace_subtractTwoNumbers( $args ) {
    $number1 = (int) $args[0];
    $number2 = (int) $args[1];
    return $number1 - $number2;
}

function mynamespace_new_xmlrpc_methods( $methods ) {
    $methods['mynamespace.subtractTwoNumbers'] = 'mynamespace_subtractTwoNumbers';
    return $methods;   
}
add_filter( 'xmlrpc_methods', 'mynamespace_new_xmlrpc_methods');

Note: Passing a single argument to a XML-RPC call will not result in an array. You then can request the value by just using $args.

Add Authenticated Method

Here is an example which authenticates the user:

function mynamespace_getUserID( $args ) {
    global $wp_xmlrpc_server;
    $wp_xmlrpc_server->escape( $args );

    $blog_id  = $args[0];
    $username = $args[1];
    $password = $args[2];

    if ( ! $user = $wp_xmlrpc_server->login( $username, $password ) )
        return $wp_xmlrpc_server->error;

    return $user->ID;    
}

function mynamespace_new_xmlrpc_methods( $methods ) {
    $methods['mynamespace.getUserID'] = 'mynamespace_getUserID';
    return $methods;   
}
add_filter( 'xmlrpc_methods', 'mynamespace_new_xmlrpc_methods');

Note that the method uses the escape method on the server class to sanitize the input values. It is best practice to always escape the input, especially if your method accesses the database.

Remove a method

Here is an example of removing the built-in demo.addTwoNumbers method:

function mynamespace_remove_xmlrpc_methods( $methods ) {
    unset( $methods['demo.addTwoNumbers'] );
    return $methods;   
}
add_filter( 'xmlrpc_methods', 'mynamespace_remove_xmlrpc_methods');

wp_xmlrpc_server_class Filter

In extremely rare cases, it may be necessary for a plugin to entirely replace the standard XML-RPC server implementation (which lives in wp-includes/class-wp-xmlrpc-server.php).

In such cases, the wp_xmlrpc_server_class filter can be used to change the name of the class instantiated to serve XML-RPC requests. The new class must have a serve_request method.