WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know of a simple plugin that allows an administrator to send messages to users that have accounts, and allow those same users to reply to the message. I found one here, but the problem is that it allows any user to send any user messages. Only the admin should be able to send messages.

Basically the idea here is to allow the admin to send messages to customers by giving updates as far as their services. Any ideas?

share|improve this question

closed as off-topic by toscho Jun 5 '14 at 20:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Do you want to send an e-mail to them, or to add private messaging functionality - with restrictions - to your WordPress? – petermolnar Sep 26 '11 at 14:04
@peremolnar Yes I was kind of aiming for a private messaging functionality. Kind of like a Customer Portal where the customers recieves updates through messages. – loyalpenguin Sep 26 '11 at 14:12

Yes, you can do this with the plugin you linked, Private Messages for WordPress.

Firstly, download version 2.1.09 - version 2.1.10 introduced mostly bugs, one of which excludes admins from the senders list.

Open the file pm4wp.php and edit line 450 to:

if ( current_user_can( 'administrator' ) )
  $users = $wpdb->get_results( "SELECT display_name FROM $wpdb->users ORDER BY display_name ASC" );
  $users = get_users( 'role=administrator' );

Look into get_users for more options.

Although as a friendly warning, you may need to do some further tweaks to make this plugin safe as it currently has a security bug. Personally I have a fix for this and the plugin author has been contacted - no response yet though.

share|improve this answer
Hi Christine, why don't you link to your proposed fix so others may be aware of it. If you have submitted a pull request or trac ticket or if you have a gist available it might be valuable to future readers in the event the author does not make a move to resolve the issue. – userabuser Jun 5 '14 at 22:59
@userabuser I am not sure if it would be a good idea to post the solution online as it would display the security issue for anyone who would like to take advantage of it. What do you think? – Christine Cooper Jun 6 '14 at 15:07
It's already known to have a security flaw which is easily exploitable by those people who would be willing to exploit the flaw. Those willing already know how to and will, with or without posting the solution. In fact I'd go as far to say that posting the solution in all of the relevant communication mediums will raise awareness to those using the plugin, those whom are considering using the plugin and also spur demand for the original author to make said changes. At worst, people can implement or employ someone to implement said fix. Knowledge is power and it's not just for the evil doers. – userabuser Jun 6 '14 at 15:45

You can add a private messaging plugin, for example Email Users, and modify the required user level for accessing the plugin.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.