{
    "title": "User Role Editor",
    "seo_title": "User Role Editor: review, recommended settings and limits",
    "h1": "User Role Editor",
    "description": "User Role Editor free or Pro: strengths, limitations, pricing, cautious settings and patched privilege escalation flaws, to manage roles safely.",
    "lead": "User Role Editor adds the screen WordPress lacks for editing roles and their capabilities, building custom roles and giving one account several roles. Our take on the free and Pro versions, the cautious settings to use and the role assignment flaws that were patched.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:29:27+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/user-role-editor/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/user-role-editor/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/user-role-editor/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/user-role-editor/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/user-role-editor/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/user-role-editor/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "User Role Editor",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/user-role-editor/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/user-role-editor/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/user-role-editor/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "User Role Editor"
        },
        {
            "level": 2,
            "text": "What User Role Editor does on your site"
        },
        {
            "level": 2,
            "text": "Which sites User Role Editor is a good fit for"
        },
        {
            "level": 2,
            "text": "User Role Editor strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The User Role Editor settings we recommend"
        },
        {
            "level": 2,
            "text": "User Role Editor security: role assignment is the weak spot"
        },
        {
            "level": 2,
            "text": "User Role Editor frequently asked questions",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for building custom roles, such as a client or copy editor role, without writing code.\n- Main caveat: role export and import and content restrictions are Pro-only.\n- Free; Pro starts at $29 per year for one site, or $87 for a lifetime license.\n\n## What User Role Editor does on your site\n\nWordPress gives every account a role (Administrator, Editor, Author, Contributor, Subscriber), and each role is just a list of permissions called capabilities: `edit_posts`, `publish_pages`, `manage_options` and so on. WordPress has no screen for changing those lists. User Role Editor adds one under Users > User Role Editor: pick a role, check or uncheck its capabilities, then click \"Update\".\n\nFrom there you can create a blank role or copy an existing one, rename it, delete roles no account uses, add a capability, or remove the leftovers of an uninstalled plugin. The plugin also lets you give one account several roles (the \"Other Roles\" section of the profile), grant capabilities to a single account, choose the roles new sign-ups receive and, on multisite, apply a change to every site in the network. It only works inside the admin area.\n\nVladimir Garagulya has developed it since 2010. The free version is published on wordpress.org; User Role Editor Pro, sold on the developer's site, adds access restriction modules: admin menus, widgets, editor meta boxes, content visible by role, role export and import, and central management of a multisite network. It also removes the ads shown on the free version's screens.\n\n![Diagram: User Role Editor works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro).](https://www.wp-masquerade.com/media/wpm-sheets/user-role-editor/diagram-en.svg?v=c04fa5d3)\n\n## Which sites User Role Editor is a good fit for\n\nUser Role Editor is a tool for least privilege: each account gets exactly what it needs and nothing more. Typical cases:\n\n- **Agency-built client sites**: a \"Client\" role that edits pages and posts without touching plugins, themes or settings.\n- **WooCommerce stores**: an order manager who doesn't need administrator capabilities, or a content role that never sees sales.\n- **Multi-author publications**: a copy editor who can review and edit other people's posts without publishing them.\n- **Cleanup after uninstalling plugins**: deleting orphaned roles and capabilities an old plugin left in the database.\n\nIt's the wrong pick if your main goal is restricting content to certain roles or moving roles between sites: in User Role Editor those features are paid, while [Members](https://www.wp-masquerade.com/features/camouflaged-plugins/members/) includes content restrictions and role export and import in its free version. For a simple split between authors and editors, the built-in WordPress roles are often enough; our guide to WordPress roles and capabilities helps you decide.\n\n## User Role Editor strengths and limitations\n\n### Strengths\n\n- **The core is free.** Create, copy, rename and delete roles, add or remove capabilities, with no limits.\n- **Multiple roles per account.** An account can hold a primary role plus others, assigned in bulk from the users list with \"Grant Roles\".\n- **Useful guardrails.** Built-in WordPress capabilities can't be deleted, and the Administrator role is hidden from the editor by default.\n- **Delegation is possible.** Its own capabilities (`ure_edit_roles`, `ure_reset_roles`...) let you hand over role management without full admin rights.\n- **Multisite support.** The \"Apply to All Sites\" option pushes an edited role to the whole network.\n\n### Limitations\n\n- **Export, import and restrictions cost extra.** They're Pro-only, while Members includes them for free.\n- **Mistakes are expensive.** Unchecking a capability applies instantly to every account with that role, and the reset tool restores the default WordPress roles while wiping those added by plugins.\n- **PHP 8.2 required.** Since version 4.66.3, hosts still on PHP 8.1 or older no longer get updates.\n- **Ads in the free version.** The plugin's screens show promotional boxes that only Pro removes.\n\n## The User Role Editor settings we recommend\n\nThe options live under Settings > User Role Editor (on multisite, in the network settings). Back up the database before changing any role: roles are stored there, and a backup is the only reliable way back.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Show Administrator role at User Role Editor**  Settings > User Role Editor > General | Off (default) | Prevents you from accidentally stripping a capability from the Administrator, the role that must keep full control. |\n| **Confirm role update**  Same tab | On (default) | A confirmation before each save catches stray clicks in a long list of checkboxes. |\n| **Edit user capabilities**  Same tab | Off, unless you have a specific need | Capabilities granted account by account bypass roles and are easy to miss during an audit. |\n| **Show deprecated capabilities**  Same tab | Off (default) | The old `level_0` to `level_10` capabilities are no longer used and clutter the list. |\n| **Show capabilities in the human readable form**  Same tab | Off (default) | Technical IDs (`edit_others_posts`) are what plugin documentation refers to. |\n| **Count users without role**  Settings > User Role Editor > Additional Modules | On for the length of an audit | Finds accounts left without a role, for example after a role was deleted, so you can reassign them. |\n| **Primary default role**  Settings > User Role Editor > Default Roles | Subscriber, or the most limited role that works | If registration is open, every new account gets this role with no review. |\n| **Reset**  Settings > User Role Editor > Tools | Don't use without a recent backup | It restores the default WordPress roles and wipes the capabilities added by WooCommerce and other plugins. |\n\n- Log in with a test account for each role you changed and check which menus and actions it gets.\n- In Users, filter the list by \"Administrator\": only the accounts you expect should appear.\n- Check which roles hold `promote_users`, `edit_users` or `manage_options`: those capabilities should stay with administrators only.\n- In Plugins, confirm that User Role Editor is on version 4.67 or later.\n\n## User Role Editor security: role assignment is the weak spot\n\nA plugin that hands out permissions is an obvious target: most of the flaws fixed in User Role Editor are [privilege escalations](https://www.wp-masquerade.com/glossary/privilege-escalation/). The ones worth knowing (developer changelog, Patchstack database):\n\n- **Version 4.25 (April 2016)**: any registered account could gain administrator access.\n- **CVE-2024-12293, fixed in 4.64.4**: with no nonce check, a booby-trapped link opened by a logged-in administrator was enough to add or remove roles, up to Administrator (CVSS 8.8).\n- **Version 4.66.2 (September 2026)**: an account with the `promote_users` capability could give itself the Administrator role through the \"Add Role\" and \"Grant Roles\" buttons.\n- **Version 4.67 (November 2026)**: the same kind of account could still assign itself a custom role more powerful than its own. Assigning a role now requires already holding its critical capabilities, and self-assignment is no longer allowed.\n\nThe last two only affect sites where a role other than Administrator holds `promote_users`, which is exactly what custom roles built with this plugin often do. Update right away and turn on automatic updates for it (see our guide to automatic plugin updates). Since User Role Editor adds nothing to public pages, camouflage matters little here; WP Masquerade Pro still removes traces of its folder and files if a page exposes them, but that never replaces updating.\n\n## User Role Editor frequently asked questions\n\n**Do my role changes disappear if I deactivate User Role Editor?**\n\nNo. Edited roles and capabilities are saved in the WordPress database, not in the plugin, so they stay in place after deactivation. Only uninstalling removes the plugin's own capabilities, the ones starting with `ure_`.\n\n**How do I undo a role change that went wrong?**\n\nThe safest way is to restore the database backup you made before the change. The \"Reset\" tool restores the default WordPress roles, but it also wipes the roles and capabilities created by your other plugins.\n\n**How much does User Role Editor Pro cost?**\n\nThe developer's site lists $29 per year for one site, $79 for five sites and $159 for unlimited sites, with lifetime licenses at $87, $198 and $318. Support and updates are included, with a 30-day money-back guarantee.\n\n## Key facts\n\n- Category: Membership and courses\n- Vendor: Vladimir Garagulya\n- Price: Free; Pro from $29 per year for one site, or $87 for a lifetime license\n- Active installations (wordpress.org): 700 000+\n- Version: 4.67\n- Official page: https://wordpress.org/plugins/user-role-editor/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs",
    "catalog": "user-role-editor",
    "essentials": [
        "Best for building custom roles, such as a client or copy editor role, without writing code.",
        "Main caveat: role export and import and content restrictions are Pro-only.",
        "Free; Pro starts at $29 per year for one site, or $87 for a lifetime license."
    ],
    "format": "application/json"
}