by PublishPress 4.7 (143 reviews)

PublishPress Capabilities: User Role Access Control, Admin Area Permissions

Name: PublishPress Capabilities: User Role Access Control, Admin Area Permissions
Rating: 4.7 (143 reviews)
Author: PublishPress

User role editing for WordPress. Manage user roles, control capabilities and permissions, and restrict admin access for any role.

PublishPress Capabilities ranks #464 among WordPress.org plugins with 90,000+ active installations, is #28 of 1,182 in the Editor & Writing category, a 4.7/5 rating from 143 reviews, and was last updated Oct 14, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v2.53.0 Current Version v2.53.0

Updated 2 weeks ago Last Update on 14 Oct, 2026

Refreshed 21 hours ago Last Refreshed on

#28 of 1,182 in Editor & Writing Top 1% by installs Downloads -29.5% this week Actively maintained

View on WordPress.org

Rank

#464

— No change

Active Installs

90K+

-12%

KW Avg Position

3.8

0.2 better

Downloads

4.5M

+415 today

Support Resolved

100%

— No change

Rating

94%

Review 4.7 out of 5

4.7 (143 reviews)

Next Milestone 100K

Total Progress 100%

90K+ 100K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 0 more installs to reach 100K+

Rank Changes

Current #464

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.7

143 reviews

Overall 94%

128 (90%)

3 (2%)

5 (3%)

1 (1%)

6 (4%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

12 known vulnerabilities on record · 5 in the last 24 months · checked 1 week ago

Oct 6, 2026 UNPATCHED

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] <= 2.45.0 (unfixed)

CVE-2026-48197 · No fix released
Sep 8, 2026

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.51.0

CVE-2026-94487 · Fixed in v2.51.0
Aug 6, 2026

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.50.0

CVE-2026-28183 · Fixed in v2.50.0
Feb 20, 2026

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.50.1

CVE-2026-75927 · Fixed in v2.50.1
Feb 20, 2026

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.32.0

CVE-2026-32394 · Fixed in v2.32.0
Oct 10, 2022

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.5.2

CVE-2022-3366 · Fixed in v2.5.2
Jan 13, 2022

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.3.3

Fixed in v2.3.3
Jan 13, 2022

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.3.3

Fixed in v2.3.3
Dec 6, 2021

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 2.3.1

CVE-2021-25032 · Fixed in v2.3.1
Jun 20, 2018

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced] < 1.5.9

Fixed in v1.5.9

Showing the 10 most recent of 12 records.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.53.0
Last Updated: Oct 14, 2026
Requires WP: 5.5+
Tested Up To: 7.1.4
PHP Version: 7.2.5 or higher
Author: PublishPress

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.7
Reviews: 143
Support Threads: 2
Resolved: 100%

Keywords

access-control capabilities permissions user role editor user roles

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

Elementor Website Builder – more than just a page builder

Advanced Editor Tools

Spectra Legacy – Gutenberg Blocks

View all Editor-and-writing plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site administrators who need to manage user roles, capabilities, and admin access. It solves the problem of controlling what different users can see and do across the WordPress dashboard, editor, profile, and frontend.

Edit and create user roles
Control WordPress capabilities
Hide Gutenberg/Classic Editor features
Remove admin toolbar and dashboard items
Customize admin area styling
Restrict navigation menu access
Redirects for login/logout/registration
Automatic permission backups

Frequently Asked Questions

Common questions about PublishPress Capabilities: User Role Access Control, Admin Area Permissions

Go to Capabilities > Roles in your WordPress admin menu. You can create a new role from scratch, or copy an existing role and adjust it — copying is usually faster, because you start from a working set of capabilities instead of an empty one. Once the role exists, open Capabilities and choose it from the dropdown in the top-left corner. Check the capabilities that role should have and save. On a multisite network you can also choose whether the new role is added to one site or the whole network. Click here to see how to manage user roles.

Changing permissions is the one part of WordPress where a mistake can shut you out of your own site, so PublishPress Capabilities is built to make that recoverable: Every change is backed up automatically, before it is applied. Go to Capabilities > Backup > Restore to roll back to any of the last 20 automatic backups, including the one taken when you first installed the plugin. Your own role is protected from changes that would remove your access to the Capabilities screens. Reset to WordPress defaults is available as a last resort under Capabilities > Backup > Reset Roles. If you are about to make a large change, take a manual backup first from the Backup tab. You can also export roles from one site and import them into another. Click here to see how to backup permissions.

Yes. The plugin is tested against the current WordPress release, and the Editor Features screen lets you hide features in both the block editor and the Classic Editor — sidebar panels such as Tags, Categories and Excerpt, the Publish button, and even the post title, body or permalink, per role.

Many plugins add admin menu links with no way to control who sees them. PublishPress Capabilities adds an Admin Menus screen where you can mark any top-level or sub-menu link as blocked for a given role. In the free version, you can hide a large amount of the admin without touching menus: use Admin Features to remove toolbar items and dashboard widgets, Profile Features to strip the Profile screen, and the Capabilities screen to remove the capability a plugin's menu depends on — which hides the menu as a side effect. Click to see how to block Admin menu access.

PublishPress Capabilities is a user role editor that offers you the ability to backup and restore your WordPress user permissions. This feature is very helpful if you want to test out changes on your site, or you've installed a new plugin that has changed your site's permissions. Changing permissions in WordPress can be a tricky task. It's possible to lock yourself or others out of some important features. So, we've built a way to keep your site safe. Every time you change your permissions, the PublishPress Capabilities plugin will automatically create a backup. If you make a mistake, go to the “Backup” menu link and click the “Restore” tab. Here you can browse through the most recent 20 automatic backups. The plugin also saves a backup from when you first installed PublishPress Capabilities. And you can click the “Backup” tab to manually create backups. Click the yellow “Restore Selected Roles” button and you'll be able to roll back to a previous version.

A green role title means the role does not exist in your current set. A green capability is set in the role backup, but not the current role. A stuck-through capability is set in the current role, but not the role backup.

If you really need to clean up and refresh your site, PublishPress Capabilities does allow you to restore the default WordPress permissions. Go to Capabilities > Backup and click the “Reset Roles” tab. Before you take next step, make sure to read this warning: “WARNING: This will delete and/or modify stored role definitions. If you have installed any plugin that adds new roles or capabilities, these will be lost. It is recommended to use this only as a last resort!” If you want to proceed, click the “Reset to WordPress defaults” link. PublishPress Capabilities will ask you if you're really sure you want to do this. Click “OK” to continue. Once the process is complete, you'll see the message, “Roles and Capabilities reset to WordPress defaults”.

With PublishPress Capabilities active, run these commands through your host's WP-CLI terminal. No WordPress admin login is required: wp capabilities backup list wp capabilities backup restore --last wp capabilities backup restore --id=capsman_backup_initial wp capabilities reset-roles Use an ID returned by the list command. Restore and reset ask for confirmation; add --yes to skip it. On multisite, add --url=https://example.com/subsite/ to select a site. Each command affects only that site. --last selects the newest manual, automatic or initial backup by its recorded date. Manual backups restore roles and backed-up feature settings, just like the admin Restore tool. Automatic and initial backups restore roles only. Reset removes custom roles and capabilities, just like Reset Roles in wp-admin; use it as a last resort. These commands do not change users' role assignments. Recovery writes the action and site ID to the PHP error log (wp-content/debug.log when configured with WP_DEBUG_LOG) and stores the latest result in the site's capsman_last_recovery option. Keep the plugin active while recovering; --skip-plugins skips its commands too.

Nothing changes back. WordPress keeps roles and capabilities in its own database option, and PublishPress Capabilities edits that option directly rather than storing a separate copy of your settings. Whatever your roles looked like when you removed the plugin is what they stay — removing it is not a way to undo a change. If you want the standard WordPress roles back, do it before you remove the plugin: Go to Capabilities > Backup > Restore and roll back to a backup from before the change, or Go to Capabilities > Backup > Reset Roles to return everything to the WordPress defaults. Both are in the free version. There is no automatic clean-up on uninstall, which is deliberate — deleting a plugin should not silently rewrite who can do what on your site.

WooCommerce is the most popular WordPress eCommerce plugin. You can create beautiful store with themes customized to your brand and industry and you'll find 1,000's of tools and popular integrations. The PublishPress Capabilities plugin enables you to control permissions for the WooCommerce plugin and also WooCommerce user roles. You can use this plugin as a WooCommerce user role editor. Go to the “Capabilities” link in your WordPress admin menu. In the main area of your screen will see options for WooCommerce Products, Orders and Coupons. These permissions cover editing, deleting and reading. In the right sidebar, you can also enable permissions for WooCommerce taxonomies. Check the boxes for Product categories, Product tags, and Product shipping classes. After you check those boxes and refresh your screen, you will see Manager, Edit, Assign and Delete options for Product categories, Product tags, and Product shipping classes. The Pro version of PublishPress Capabilities allows you to block access to admin menu links in WooCommerce. This is useful because WooCommerce has very limited options for controlling who can access the admin screens. When you first install WooCommerce, you'll see four top-level menu links, plus sub-menus. All of these links are available to users in the Administrator and Shop Manager roles: WooCommerce Products Analytics Marketing It is possible to control who can access these links by using the PublishPress Capabilities plugin. After installing PublishPress Capabilities, go to “Capabilities”, then “Admin Menus” in your WordPress admin area. In the top-left corner of this screen, choose the role that you want to edit. Scroll down and you can enter a red X for any menu link that you don't want users in that role to access. This is a great way to customize a WooCommerce role such as Shop Manager. This approach works for the core WooCommerce plugin and can also be used for WooCommerce add-on plugins such as WooCommerce Subscriptions, WooCommerce Shipping, and WooCommerce Bookings. PublishPress Capabilities can help you manage WooCommerce permissions. Click here to learn about WooCommerce menu permissions.