Vladimir Garagulya

Hi,

It’s located under the “Users->User Role Editor”, not under the “Settings->User Role Editor”.

Yes, you can deactivate URE after finishing modification user roles and capabilities. It saves changes directly to the WP core database table and it’s not needed in order those changes used by WP.

Take into account, if you grant to someone edit users, URE automatically protects users with administrator role from such users – hides their records from the users list.

If someone except user with administrator role is granted to ‘activate_plugins’, URE automatically hides itself from the “Plugins” list for such user.

It also adds some UI elements to the “Users” page.

If you don’t need listed additional features you don’t need to keep plugin active.

WordPress sums capabilities from all roles granted and checks the full list of capabilities, not from the last granted role only. It uses function current_user_can( ) for this purpose.

Re-check if something is wrong with your test.

It’s better to ask MM plugin support. I don’t have access to this commercial product to find an answer myself.

Yes, ‘read’ capability is required for access to wp-admin dashboard.

There is no special built-in permission in WordPress to allow/prohibit schedule publishing of posts/pages.

All changes to the user roles made via URE are permanent and does not depend from the presence of URE on the site.

Read this article

https://www.role-editor.com/woocommerce-admin-bar-access/

Do you have active WooCommerce on site?

Thank you.

If user can install plugin, that is execute on your server any PHP code, it can get superadmin credentials in a minute. WordPress user permissions manage user access to WordPress UI, but lose sense if such user has access to the database via PHP code executed as new installed plugin.

Problem would be related to the data cache. Try to clear all cache, clear browser cookie too.

Role you added will not be deleted in any case. To know the rest read the article below:

https://role-editor.com/documentation/install-pro-version-not-lose-changes-made-free-version/

Do you use WooCommerce?

If Yes, any other user except admin can edit users with ‘Customer’ role only, by default. It’s possible to change this via filter though:

https://woocommerce.wordpress.com/2018/10/11/woocommerce-3-4-6-security-fix-release-notes/

“Authorizer” admin menu item is protected by ‘create_users’ capability. Grant it to a role, which should have access to the “Authorizer”.

‘edit_users’ capability may be required also – according to the source code of the Authorizer plugin.

I suppose test user has shop_manager role and you granted to it (if absent) list_users, edit_users capabilities.

Without additional code: Test user with conditions above should can edit another user with ‘customer’ role. Does he?

If you add exactly code from the link above: test user should can edit other users with ‘editor’ role in addition to users with ‘customer’ role. Does he?

Pay attention code will allow to user edit only users with customer role and roles which you add via that code.

Hi Laure,

If it’s a single WordPress installation turning ON the ‘unfiltered_html’ capability may help. If role does not have such capability, WP automatically removes any content containing potentially dangerous html tags.

If it’s a multisite WP installation, ‘unfiltered_html’ is prohibited by default for all users except superadmin. URE Pro includes a workaround for this security measure, with warning that it’s unsecure and you should trust your editors when allow them to use unfiltered html.