Capability Checks Are The Permission Boundary

A hidden WordPress button is not authorization. Least privilege works because every privileged action should require the smallest permission necessary at the moment the action runs. In WordPress, navigation and callbacks are separate surfaces. A menu capability keeps the screen tidy; the callback capability keeps the data safe. Mechanism The failure mode is confused authority. A user may not see a button but may still reach a URL, replay an old form, call an endpoint directly, or be tricked into submitting a request. The server must make the permission decision again using the current user and the current object. WordPress…

Sign up free — one personalized lesson every day, matched to your role and goals.

Already have an account? Sign in