What User Role Editor does on your site
WordPress gives every account a role (Administrator, Editor, Author, Contributor, Subscriber), and each role is just a list of permissions called capabilities: edit_posts, publish_pages, manage_options and so on. WordPress has no screen for changing those lists. User Role Editor adds one under Users > User Role Editor: pick a role, check or uncheck its capabilities, then click "Update".
From there you can create a blank role or copy an existing one, rename it, delete roles no account uses, add a capability, or remove the leftovers of an uninstalled plugin. The plugin also lets you give one account several roles (the "Other Roles" section of the profile), grant capabilities to a single account, choose the roles new sign-ups receive and, on multisite, apply a change to every site in the network. It only works inside the admin area.
Vladimir Garagulya has developed it since 2010. The free version is published on wordpress.org; User Role Editor Pro, sold on the developer's site, adds access restriction modules: admin menus, widgets, editor meta boxes, content visible by role, role export and import, and central management of a multisite network. It also removes the ads shown on the free version's screens.
Which sites User Role Editor is a good fit for
User Role Editor is a tool for least privilege: each account gets exactly what it needs and nothing more. Typical cases:
- Agency-built client sites: a "Client" role that edits pages and posts without touching plugins, themes or settings.
- WooCommerce stores: an order manager who doesn't need administrator capabilities, or a content role that never sees sales.
- Multi-author publications: a copy editor who can review and edit other people's posts without publishing them.
- Cleanup after uninstalling plugins: deleting orphaned roles and capabilities an old plugin left in the database.
It's the wrong pick if your main goal is restricting content to certain roles or moving roles between sites: in User Role Editor those features are paid, while Members includes content restrictions and role export and import in its free version. For a simple split between authors and editors, the built-in WordPress roles are often enough; our guide to WordPress roles and capabilities helps you decide.
User Role Editor strengths and limitations
Strengths
- The core is free. Create, copy, rename and delete roles, add or remove capabilities, with no limits.
- Multiple roles per account. An account can hold a primary role plus others, assigned in bulk from the users list with "Grant Roles".
- Useful guardrails. Built-in WordPress capabilities can't be deleted, and the Administrator role is hidden from the editor by default.
- Delegation is possible. Its own capabilities (
ure_edit_roles,ure_reset_roles...) let you hand over role management without full admin rights. - Multisite support. The "Apply to All Sites" option pushes an edited role to the whole network.
Limitations
- Export, import and restrictions cost extra. They're Pro-only, while Members includes them for free.
- Mistakes are expensive. Unchecking a capability applies instantly to every account with that role, and the reset tool restores the default WordPress roles while wiping those added by plugins.
- PHP 8.2 required. Since version 4.66.3, hosts still on PHP 8.1 or older no longer get updates.
- Ads in the free version. The plugin's screens show promotional boxes that only Pro removes.
The User Role Editor settings we recommend
The options live under Settings > User Role Editor (on multisite, in the network settings). Back up the database before changing any role: roles are stored there, and a backup is the only reliable way back.
| Setting | Recommended value | Why |
|---|---|---|
| Show Administrator role at User Role Editor Settings > User Role Editor > General | Off (default) | Prevents you from accidentally stripping a capability from the Administrator, the role that must keep full control. |
| Confirm role update Same tab | On (default) | A confirmation before each save catches stray clicks in a long list of checkboxes. |
| Edit user capabilities Same tab | Off, unless you have a specific need | Capabilities granted account by account bypass roles and are easy to miss during an audit. |
| Show deprecated capabilities Same tab | Off (default) | The old level_0 to level_10 capabilities are no longer used and clutter the list. |
| Show capabilities in the human readable form Same tab | Off (default) | Technical IDs (edit_others_posts) are what plugin documentation refers to. |
| Count users without role Settings > User Role Editor > Additional Modules | On for the length of an audit | Finds accounts left without a role, for example after a role was deleted, so you can reassign them. |
| Primary default role Settings > User Role Editor > Default Roles | Subscriber, or the most limited role that works | If registration is open, every new account gets this role with no review. |
| Reset Settings > User Role Editor > Tools | Don't use without a recent backup | It restores the default WordPress roles and wipes the capabilities added by WooCommerce and other plugins. |
- Log in with a test account for each role you changed and check which menus and actions it gets.
- In Users, filter the list by "Administrator": only the accounts you expect should appear.
- Check which roles hold
promote_users,edit_usersormanage_options: those capabilities should stay with administrators only. - In Plugins, confirm that User Role Editor is on version 4.67 or later.
User Role Editor security: role assignment is the weak spot
A plugin that hands out permissions is an obvious target: most of the flaws fixed in User Role Editor are privilege escalations. The ones worth knowing (developer changelog, Patchstack database):
- Version 4.25 (April 2016): any registered account could gain administrator access.
- CVE-2024-12293, fixed in 4.64.4: with no nonce check, a booby-trapped link opened by a logged-in administrator was enough to add or remove roles, up to Administrator (CVSS 8.8).
- Version 4.66.2 (September 2026): an account with the
promote_userscapability could give itself the Administrator role through the "Add Role" and "Grant Roles" buttons. - Version 4.67 (November 2026): the same kind of account could still assign itself a custom role more powerful than its own. Assigning a role now requires already holding its critical capabilities, and self-assignment is no longer allowed.
The last two only affect sites where a role other than Administrator holds promote_users, which is exactly what custom roles built with this plugin often do. Update right away and turn on automatic updates for it (see our guide to automatic plugin updates). Since User Role Editor adds nothing to public pages, camouflage matters little here; WP Masquerade Pro still removes traces of its folder and files if a page exposes them, but that never replaces updating.
What WP Masquerade hides for User Role Editor
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to User Role Editor: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
No known trace
User Role Editor frequently asked questions
Do my role changes disappear if I deactivate User Role Editor?
No. Edited roles and capabilities are saved in the WordPress database, not in the plugin, so they stay in place after deactivation. Only uninstalling removes the plugin's own capabilities, the ones starting with ure_.
How do I undo a role change that went wrong?
The safest way is to restore the database backup you made before the change. The "Reset" tool restores the default WordPress roles, but it also wipes the roles and capabilities created by your other plugins.
How much does User Role Editor Pro cost?
The developer's site lists $29 per year for one site, $79 for five sites and $159 for unlimited sites, with lifetime licenses at $87, $198 and $318. Support and updates are included, with a 30-day money-back guarantee.