I've created a "Second Administrator" role to avoid the worst case scenario happening on my WordPress site when I have casual web development contractors. However if I give them the 'promote_users' capability, can they promote a random user to an Admin and then circumvent the limitations in place?
Yes, if you assign 'promote_users' to another user, that user could promote non-site admins to site admin.
From the docs:
- Enables the "Change role to..." dropdown in the admin user list. This
- does not depend on 'edit_users' capability.
So it would appear that yes, a casual contractor could promote a random user to an administrator, but you may be missing the point:
If someone is doing development work on your site and they have any of the following access or permissions they can (should they be so inclined) own your site:
- FTP access with write permissions
- Remote database access
- cPanel or other hosting access
- WordPress user access at Editor level or above
- A whole bunch of individual permissions including, but not limited to:
So choose your freelancers with care!