Not able to access WP Admin, it says "Sorry, you are not allowed to access this page."

Question

All of a sudden we are not able to get to the admin panel of the website. Once I log into /wp-login.php it redirects me to the homepage or /wp-admin (depending on whether I visited wp-admin in logged out state or not)

WordPress version: 5.6.2

When it does redirect to /wp-admin I see:

"Sorry, you are not allowed to access this page."

My first guess was that someone (maybe another user with administrator access) changed the roles. That wasn't the case, I confirmed by looking at the database tables and the users had the wp_capabilities that corresponded to being an admin.

Then I tried a bunch of other stuffs and none worked:

1. Created a new user using wp_create_user, added administrator capabilities, logged into that account from a private browsing window. Same.

2. Went to the WordPress git repo searched for where "Sorry, you are not allowed to access this page." appeared, it did at many places so I added random string of text in some files to see exactly which one, it came from the file wp-admin/includes/menu.php in the last lines:

   if ( ! user_can_access_admin_page() ) {

3. I thought maybe user_can_access_admin_page() returned wrong information for some reason, so I used a page template to output some data like so

if ( current_user_can('administrator') ) {
    echo "Yes, admin";
}

if ( user_can_access_admin_page() ) {
    echo "Can access admin";
} else {
    echo "Can't access admin";
}

Both returned true, yet the check on menu.php fails. Not sure why.

4. Replaced wp-admin and wp-includes folder with fresh copies downloaded from Wordpress org.

5. Renamed the theme and plugin folders to rule out the problem coming from a plugin or theme. Not the case, it still was the same.

6. Checked the error log of Apache2 as well as enabled debugging log for WP to look for any related error, none found. Nothing special, all the usual PHP notices that I have seen before.

7. At one point I noticed the SSL certificate expired a month ago (problem started yesterday though) so just to be sure I renewed that as well, still the same.

Anybody who have an idea on what might be wrong would be a great help!

Answer 1

I managed to solve this.

Reason was that: The data about user roles, that's set by default in a WordPress installation was completely missing in the db table wp_options under the wp_user_roles row.

In my case it was this

a:3:{s:14:"backwpup_admin";a:2:{s:4:"name";s:14:"BackWPup Admin";s:12:"capabilities";a:12:{s:4:"read";b:1;s:8:"backwpup";b:1;s:13:"backwpup_jobs";b:1;s:18:"backwpup_jobs_edit";b:1;s:19:"backwpup_jobs_start";b:1;s:16:"backwpup_backups";b:1;s:25:"backwpup_backups_download";b:1;s:23:"backwpup_backups_delete";b:1;s:13:"backwpup_logs";b:1;s:20:"backwpup_logs_delete";b:1;s:17:"backwpup_settings";b:1;s:16:"backwpup_restore";b:1;}}s:14:"backwpup_check";a:2:{s:4:"name";s:21:"BackWPup jobs checker";s:12:"capabilities";a:12:{s:4:"read";b:1;s:8:"backwpup";b:1;s:13:"backwpup_jobs";b:1;s:18:"backwpup_jobs_edit";b:0;s:19:"backwpup_jobs_start";b:0;s:16:"backwpup_backups";b:1;s:25:"backwpup_backups_download";b:0;s:23:"backwpup_backups_delete";b:0;s:13:"backwpup_logs";b:1;s:20:"backwpup_logs_delete";b:0;s:17:"backwpup_settings";b:0;s:16:"backwpup_restore";b:0;}}s:15:"backwpup_helper";a:2:{s:4:"name";s:23:"BackWPup jobs functions";s:12:"capabilities";a:12:{s:4:"read";b:1;s:8:"backwpup";b:1;s:13:"backwpup_jobs";b:1;s:18:"backwpup_jobs_edit";b:0;s:19:"backwpup_jobs_start";b:1;s:16:"backwpup_backups";b:1;s:25:"backwpup_backups_download";b:1;s:23:"backwpup_backups_delete";b:1;s:13:"backwpup_logs";b:1;s:20:"backwpup_logs_delete";b:1;s:17:"backwpup_settings";b:0;s:16:"backwpup_restore";b:0;}}}

Whereas it should have Administrator at least somewhere. And this missing data in the database caused the WordPress system to behave weird (actually working just as expected in the scenario of the missing data)

I knew what it should look like but to test it what I did was got the wp_user_roles from another WP site I manage and pasted it in the field in the table and saved and baam! The site opened.

Now why this happened all of a sudden?

Well in my case it seems like there had been some sort of breach, an attack, because now that I am in the dashboard the first I did was I went to the user's page and there's a bazillion strange user accounts.

So I have got another job to do now that is to find out the cause and clean the mess up but for anyone having troubles figuring out problems with accessing the WP admin page and see the error message, and nothing works, like disabling plugins etc then do take a look at the actual database fields whether it is in line or not. I was able to pinpoint that by using simply print_ring the user object and noticed there were no roles, then I used methods to add the Administrator role and it simply didn't add to it, and then I figured that the role Administrator is missing itself.