1

I've created a "Second Administrator" role to avoid the worst case scenario happening on my WordPress site when I have casual web development contractors. However if I give them the 'promote_users' capability, can they promote a random user to an Admin and then circumvent the limitations in place?

  • 1
    In general, casual contractors shouldn't have access to your production site. Let them only have an access to a "sandbox", at most, but you should consider the various local/q&a/staging/production developement methods available out there. – birgire Sep 26 '16 at 9:59
  • The scale of this project does not warrant multiple development environments. We do have a careful system for backups online and offline, and one day of downtime would not be highly detrimental. – EnglishTeacherEric Sep 26 '16 at 17:30
2

Yes, if you assign 'promote_users' to another user, that user could promote non-site admins to site admin.

https://codex.wordpress.org/Roles_and_Capabilities#promote_users

  • 1
    Thank you for answering the question in a straightforward manner. – EnglishTeacherEric Sep 26 '16 at 17:32
0

From the docs:

  • Enables the "Change role to..." dropdown in the admin user list. This
    • does not depend on 'edit_users' capability.

So it would appear that yes, a casual contractor could promote a random user to an administrator, but you may be missing the point:

If someone is doing development work on your site and they have any of the following access or permissions they can (should they be so inclined) own your site:

  • FTP access with write permissions
  • Remote database access
  • cPanel or other hosting access
  • WordPress user access at Editor level or above
  • A whole bunch of individual permissions including, but not limited to:
    • edit_files
    • install_plugins
    • unfiltered_html

So choose your freelancers with care!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.