Users without ‘edit_users’ can switch roles

  • Resolved chenryahts

    (@chenryahts)


    1 day, 19 hours ago

    Woocommerce members who do not have the ‘edit_users’ capability are able to select ‘switch to’ from other member’s profile pages and successfully switch to their profile.

    All of the capabilities are setup correctly, but this shouldn’t be possible. Any ideas?

Viewing 1 replies (of 1 total)
  • Plugin Author John Blackbourn

    (@johnbillion)

    WordPress Core Developer

    1 day ago

    A user can only switch to another user if they have the ability to edit the target user (which WordPress by default maps to the edit_users capability) or they have been granted the switch_to_user or switch_users capability.

    WooCommerce doesn’t have member profile pages so I would check whatever plugin it is you’re using for member profiles as well as any plugins you’re using for user role customisation.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.