Security issue

Hi, why if I add the ability to create user and edit them to the editor role, this role can create administrator? the correct configuration should be that one editor can at most create another editor! Hi, Could you please specify what plugin version you use? Hi, the last one, 1.6.6 Hi, There is the feature of the User Role plugin that you can manage existing user role capabilities. And you can provide capabilities of administrator for a role with any name. So if you don’t want that user with the editor role was able to create or edit other users, please don’t provide the editor role with that capability. clear, but it would be logical to think that instead an editor can change the roles to similar or subordinate users, but not make an escalation of privileges so simply. To me it seems like a real bug, you say it’s a feature? Ok Hi, We will consider the question that you reported, and if we deem it necessary, we will make the changes to the plugin.