A role name is an administrative shortcut. The security decision happens at the capability check attached to a server-side action. An audit must prove what each account can read, create, change, export, and delete – including actions reached without the visible menu.
Inventory consequential actions
Start with money, agreements, customer data, configuration, user management, exports, deletion, and workflow state. Include background and indirect actions such as webhooks, bulk tools, REST routes, AJAX handlers, scheduled jobs, imports, and impersonation.
Capability matrix row
Action: ______
Business risk and data scope: ______
Required capability: ______
Allowed roles: ______
Object ownership or record-level rule: ______
Test request and expected denial: ______
Audit event: ______
Map capabilities, not menus
The official WordPress documentation explains roles and capabilities. A plugin should check the capability appropriate to the action; removing a menu item or hiding a button is not authorization because a user may still send the underlying request.
Test four access layers
- Navigation: is the action discoverable to the intended person?
- Request authorization: does the server reject a user without the capability?
- Record scope: can an allowed user act only on appropriate records, sites, stores, or clients?
- Data exposure: do lists, exports, APIs, logs, and error messages reveal more than the role needs?
Use least privilege as a workflow exercise
Do not begin by cloning Administrator and removing visible pages. Give the role the smallest capability set that completes its defined work, then add only evidence-backed needs. Separate routine operations from exceptional authority such as refunds, plugin installation, user creation, or bulk export.
Run direct negative tests
For each action, sign in as a role that should be denied and attempt:
- The normal screen and button.
- The saved administrative URL.
- The AJAX or REST request with a valid session but missing capability.
- A different record ID, including one owned by another user or account.
- A bulk action, import, or export.
- A stale link after the role is removed.
Nonces help protect request intent but are not a replacement for a capability and record-scope check.
Inspect plugin-defined roles over time
Activation routines often add capabilities once. Updates can add new actions without updating existing roles, and uninstall routines can leave obsolete capabilities behind. Compare the documented matrix with the live role registry after installation, update, deactivation, and removal in staging.
Protect exports and bulk tools
An account that may view one record does not automatically need a full customer export. Define separate capabilities, filters, justification, and audit events for bulk access. Protect generated files with access checks and short retention; do not leave predictable exports in a public uploads path.
Build break-glass access
Keep a documented emergency administrator path with strong authentication, limited custodians, alerting, and post-use review. Do not make every routine operator an administrator because emergency access might be needed someday.
Review logging without creating a second data leak
Log the actor, action, target identifier, time, result, and high-level change needed for review. Avoid writing secrets or complete sensitive records into general logs. Restrict log access and set retention based on the actual investigation need.
Audit cadence
- Before a new operational plugin launches.
- After a material plugin or WooCommerce update.
- When a role’s job changes.
- After staff departure or vendor access ends.
- After an incident, unexpected denial, or unauthorized action.
- On a regular review schedule appropriate to the risk.
Use the matrix during the plugin procurement decision, not only after installation. If permissions control order transitions, pair it with the WooCommerce state model.
Place this capability review inside the broader WordPress security checklist, which also covers identities, extensions, backups, files, monitoring, and incident recovery.