I would like to make possible to any visitors (non-users) to create a custom post from the WP frontend, then get a password in email which can let him/her edit the post if the proper password is given.

Now my focus is only on the capabilities part. Is there a native WP solution to make a CPT post editable to non-users who can enter the required password to that specific post?

I would like to avoid generating extra number of Users for this feature, if possible.

*:The created post would be assigned to the Admin by default.

Thank you for any alternatives!

1 Answer 1


I would suggest having a generic form that can be completed by the public on the front end. The submission of the form would would generate the post, saving a random string in its meta data (the password), and send an email containing a link to /?p=PAGEID&post_id=THE_POST_ID&pw=THE_PASSWORD. THE_POST_ID and THE_PASSWORD are those values from the post generated, and the PAGEID is a page you created that contains shortcode to handle the editing. Not to get too far into detail, but your shortcode would be something like this:

add_shortcode('viktor_edit_post', function() {
    // Sanitize
    $_REQUEST['post_id'] = absint($_REQUEST['post_id']);

    // Validate
    || get_post_status($_REQUEST['post_id']) === FALSE
    || get_post_meta($_REQUEST['post_id'], 'pw', TRUE) !== $_REQUEST['pw']
    ) {
        // I would suggest echoing the public form here and handling its submission
        // here as well.  I think it would be preferable as you need not hard-code
        // the PAGEID because this shortcode sits on that page.  You could get it by way
        // of the global $page (as done below).

    // If edit submission, update.
    if(wp_verify_nonce('viktor_nonce_'.$_REQUEST['post_id'], 'viktor_check')
    && isset($_REQUEST['new_post_content'])
    ) {
            'ID'            => $_REQUEST['post_id'],
            'post_content'  => sanitize_textarea_field($_REQUEST['new_post_content']);

    // Display edit form
    global $post;
    ?><form action='/?p=<?= $post->ID ?>' method='POST'>
    <?php wp_nonce_field('viktor_check', 'viktor_nonce_'.$_REQUEST['post_id'], FALSE); ?>
    <input type='hidden' name='post_id' value='<?= $_REQUEST['post_id'] ?>'>
    <input type='hidden' name='pw' value='<?= $_REQUEST['pw'] ?>'>
    <p><?= sprintf(
        __('Please make changes as you see fit to %s.'),
    ) ?></p>
    <textarea name="new_post_content"><?= get_the_content(NULL, FALSE, $_REQUEST['post_id']) ?></textarea>
    <?php submit_button('Save'); ?>

The deal here is that you're not messing around with capabilities, which control the users of your site. As you want to deal with non-users as well, I think a simple shortcode plugin is the way to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.