Wordpress: Why can subscribers see the admin panel?

Question

One of my clients is running a wordpress site with Woocommerce. I was recently asked to log in as one of their users, in order to replicate an issue.

What I found was that I can type /wp-admin and it just takes me to the full blown admin panel and I have all the same menu items as an admin. This is obviously very serious because if any of the users figures this out, they could take the site down if they wanted.

In an attempt to block them, I placed the following script in the functions.php file:

//  Redirect non-admins away from wp-admin
add_action( 'init', 'blockusers_init' );

function blockusers_init() {
    $current_user = wp_get_current_user();

    if ( is_admin() && ! current_user_can( 'administrator' ) && ! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
        wp_redirect( home_url() );
        exit;
    }
}

After logging in as a user that has a "subscriber" role, current_user_can( 'administrator' ) returns false if I am on the front-end of the site, and it returns true if I go to /wp-admin.

Since the current user is only a subscriber, I assume it should return false everywhere.

I'm a bit stuck with this...and I don't know what I should look at next. (I tried the usual stuff like disabling all plugins, but the issue is still there). Do you guys have any idea about what I should be trying next?

have you clicked through the admin panel and checked that it is actually the admin panel and not the personal user settings admin panel? — Keith M
Did you checked the "New User Default Role" option in the General settings ? — JazZ

Igor Yavych Igor Yavych · Accepted Answer · 2017-08-24T19:23:04

Your check is incorrect. You're doing !wp_admin(). It's true when you're not in admin panel, which is exact opposite of what you want.

add_action('init', 'blockusers_init');

function blockusers_init()
{
    if (is_admin() && !current_user_can('administrator') && !( defined('DOING_AJAX') && DOING_AJAX ))
    {
        wp_redirect(home_url());
        exit;
    }
}

Note, that it can be either current_user_can('subscriber') to target only subscribers, or !current_user_can('administrator') to target all non administrators, meaning editors, contributors, etc.

Whole situation is weird though. Normally, a subscriber can access admin panel, but they only can see dashboard and their profile. If they in fact can see whole admin panel, you should investigate the cause, as it's abnormal.
P.S. Are you sure they didn't give you admin account instead of subscribe to investigate?

Wordpress: Why can subscribers see the admin panel?

2 Answers