In order to allow editors to edit other's author meta (update_user_attribute), I must give them the 'manage_options' capability or else I get a 'Cheatin' huh' die message. I only want to give them this capability on one specific Edit Author Meta page.

I give 'editor' permission to 'list_users' to access the Users admin table. I give 'editor' permission to 'manage_options' upon entering the specific author meta page. (I tried placing at the top of function save_profile_fields but still got the die message.)

I remove the 'manage_options' capability at the bottom of the save_profile_fields function. This works, but if the editor neglects to save anything on the author meta page, the editor keeps the 'manage_options' capability.

if( !current_user_can( 'manage_options' ) && current_user_can( 'edit_others_posts' ) ){
    $edit_editor_role = get_role( 'editor' );
    $edit_editor_role->add_cap( 'manage_options' );

Where would one remove the capability 'manage_options' from the editor role?

$edit_editor_role = get_role( 'editor' );
$edit_editor_role->remove_cap( 'manage_options' );

1 Answer 1


Good question! The capability checking is probably done quite early in the loading process. By looking at /wp-admin/users.php you can tell that one of the first things to happen is current_user_can( 'list_users' ), so that one is clearly needed or you'll get the "Cheatin' uh?" warning. But right before that, /wp-admin/admin.php is included, and at the bottom of that file WordPress will call an individual action for each page, load-users.php when loading wp-admin/users.php.

This means you should be able to setup a function to add the capabilities needed to perform your tasks during loading of that page (given that the current user has sufficient permissions to begin with, naturally). Something like this might work when giving a user new capabilities on the users list and user edit pages:

function my_add_caps() {
    // add capabilities here
add_action('load-users.php', 'my_add_caps');
add_action('load-profile.php', 'my_add_caps'); // might be needed if you somehow cannot edit your own user
add_action('load-user-edit.php', 'my_add_caps');

I wouldn't worry too much about removing the capabilities though, once the page is loaded the added capability will have played out its part. Keep in mind though that you might have to add the capability for admin pages responsible for storing options, or any AJAX-request handlers, depending on how much capability checking is done by WordPress during validation/storing of options.

  • the capability is added on the page load, but unfortunately it stays there afterwards.
    – AlxVallejo
    Commented Jan 30, 2013 at 19:53
  • Oh, I must have misunderstood your question, sorry about that. Perhaps a workaround could be to use the Transients API regularly reset permissions, or perhaps update_user_meta to store info about which users have been granted extend permissions, and simply clear it on init unless its needed for the currently loading page?
    – Simon
    Commented Jan 30, 2013 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.