Currently using wp_editor(); on the front-end of my website as a content submission form. All posts submitted are set as a "Pending", which will later be published or deleted by an administrator.

The "Add Media" button has been allowed in the wp_editor(); call.

Users are required to be registered and logged in with a user role of "author".

Authors are allowed to manage their own posts. However, when clicking the "Add Media" button as an author user, all uploads fail. Due to the fact that anything uploaded via wp_editor(); is adding the attachments to that page. Which would require the user to have the following capabilities: edit_pages, edit_published_pages, and edit_others_pages, but as you know... the default capabilities for an "Author" user doesn't have these capabilities, which in-turn, causes the upload to fail.

My work around solution:

public function modify_author_role(){
        $role = get_role('author');
    } else{
        $role = get_role('author');
add_action('template_redirect', array($this, 'modify_author_role'));

So when the Author user is logged in, and viewing the content submission page, they are temporarily granted the capabilities: edit_pages, edit_published_pages, and edit_others_pages, while removing the capability: read (denying access to the dashboard -- if attempted to access while on the content submission page)

If the author user is on any other page of the website, or directly accesses the dashboard, they will have normal access, and normal author capabilities.

So the author user is only temporarily granted higher privileges while submitting content on the front-end of the website.

I just feel like this is a huge security risk. There's GOT to be a more elegant solution than this.

Is there some way that I can tell the uploads made via wp_editor(); on the content submission page to just allow the author user to upload the file and not attach it to the content submission page (remaining unattached)?

1 Answer 1


Yes the better solution is to use add_role( $role, $display_name, $capabilities ); and make a distinct role for the front end.

That way you have a separation of abilities that is easier to manage, the way you are doing it will lead to trouble.

  • I cannot create a new role. Client would like to keep all users as an "Author". I have modified the Author role though. Removing dashboard access and publishing rights. They can still receive the rest of the normal Author capabilities. I don't really know if this is a good solution or not, but I edited the global variable for post_id, right before the call to wp_editor(); Example: $GLOBALS['post']->ID = null; wp_editor(); Commented Jun 26, 2013 at 18:14
  • That is a failure of the basic principle of a software design pattern. There is no reason you should be doing it wrong, despite the client.
    – Wyck
    Commented Jun 27, 2013 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.