Title: Capveriq – Permission & Access Debugger Author: Muhammad Mujahid Sarfraz Published: September 24, 2026 Last modified: September 24, 2026 --- Search plugins ![](https://ps.w.org/capveriq-permission-access-debugger/assets/banner-772x250.png? rev=3710503) ![](https://ps.w.org/capveriq-permission-access-debugger/assets/icon.svg?rev=3710503) # Capveriq – Permission & Access Debugger By [Muhammad Mujahid Sarfraz](https://profiles.wordpress.org/mujahidwp/) [Download](https://downloads.wordpress.org/plugin/capveriq-permission-access-debugger.1.0.1.zip) * [Details](https://wordpress.org/plugins/capveriq-permission-access-debugger/#description) * [Reviews](https://wordpress.org/plugins/capveriq-permission-access-debugger/#reviews) * [Installation](https://wordpress.org/plugins/capveriq-permission-access-debugger/#installation) * [Development](https://wordpress.org/plugins/capveriq-permission-access-debugger/#developers) [Support](https://wordpress.org/support/plugin/capveriq-permission-access-debugger/) ## Description Capveriq helps WordPress administrators find out why a user cannot access an admin page or perform an action. Instead of editing roles blindly, Capveriq inspects roles, effective capabilities, registered admin-menu requirements, mapped capabilities and temporary runtime permission traces. Capveriq is a diagnostic tool and does not automatically modify user permissions. **The problem Capveriq is built for** You have probably seen these messages: * “Sorry, you are not allowed to access this page.” * “You do not have permission to perform this action.” A menu item disappears. A plugin screen becomes unavailable. A user has what looks like the correct role and is still denied. Role editors show you capability checkboxes, but they do not tell you _why_ the request failed. Capveriq answers a different question: which capability did the page require, does this user have it, and did anything change the decision at runtime? **What Capveriq examines** * The capability registered by the admin menu or submenu entry for the requested page. * The selected user’s roles, role-provided capabilities and directly assigned capabilities. * Meta capability mapping through the WordPress `map_meta_cap` API. * Runtime capability results through the `user_has_cap` filter. * Callbacks that other plugins and themes have registered on those permission hooks. * Multisite and Super Admin context. * Request context: wp-admin, frontend, AJAX, REST, cron, WP-CLI and Network Admin. **Honest diagnostics** Results use Confirmed, Likely, Possible or Unknown confidence labels. Capveriq does not present inference as proof. When evidence is insufficient it reports Inconclusive and recommends Live Trace. **Read-only by design** Capveriq never adds, removes or edits roles, capabilities or users. It reads, explains and reports. **Local only** Diagnostics run locally. Capveriq uses no external API, telemetry, remote fonts, account or licence key. ### Features * Access diagnosis for any user against any wp-admin URL. * Admin menu and submenu capability detection from the live `$menu` and `$submenu` data. * Core admin page analysis with a maintained fallback map. * Plugin and custom admin page analysis. * User capability inspector with search and All / Allowed / Denied / Direct / Inherited filters. * Role capability inspector (read-only). * Capability test tool with optional object ID and meta capability mapping. * Temporary Live Trace for one selected user, with 5, 10 or 15 minute durations. * `user_has_cap` and `map_meta_cap` observation that never alters permission results. * Hook callback inventory with plugin, MU-plugin, theme, child theme and core classification. * Denied admin access logging with retention and record limits. * Request context detection including AJAX, REST, cron, WP-CLI and Network Admin. * Multisite and Super Admin awareness. * Privacy-safe diagnostic report export and a full system report. * Diagnostic data cleanup tools and optional data removal on uninstall. ### How It Works 1. Open **Capveriq > Diagnose Access**. 2. Select the affected user and paste the wp-admin URL they cannot open. 3. Run the analysis. Capveriq reports the capability the page requires, whether the user has it, and where that capability comes from. 4. If static analysis is not conclusive, start a **Live Trace** for that user. 5. Ask the affected user to reproduce the problem while the trace is running. 6. Return to Capveriq and review the captured capability checks, mapped capabilities and the callbacks registered on the relevant permission hooks. 7. Export a privacy-safe report and share it with your developer or with the responsible plugin’s support team. The trace expires automatically. Nothing about your site’s permissions is changed at any point. ### Privacy Capveriq stores diagnostic data in your own WordPress database and sends nothing to any external service. Capveriq never stores passwords, cookies, authorization headers, API keys, application passwords, nonce values, payment data, POST form contents, private messages or any credential from `wp-config.php`. Trace events record the capability being checked, the mapped capabilities, the result, the request path and context, and the classified source file where one can be determined. Absolute server paths are reduced to site-relative paths such as `wp-content/plugins/ example/file.php`, so hosting account names and home directories are never displayed. With **Privacy-safe Reports** enabled (the default), exported reports mask the site domain, identify users by ID rather than by email address, and exclude server paths, IP addresses and authentication information. Trace sessions and denied access records are pruned automatically using the retention period you configure, while the denied log also respects its maximum record count. You can clear trace data, the denied access log or all diagnostic data at any time from **Capveriq > Settings**. Capveriq integrates with WordPress personal data export and erasure tools for diagnostic records associated with registered users, and removes those records when the related WordPress user is deleted. When **Delete Data on Uninstall** is enabled, all Capveriq tables and options are removed when the plugin is deleted. ### Developers Diagnostic data lives in three custom tables created with `dbDelta()`: * `{prefix}capveriq_sessions` * `{prefix}capveriq_events` * `{prefix}capveriq_denied` When Live Trace is off, Capveriq performs no `debug_backtrace()` calls, no reflection on hook callbacks and no trace database writes, and it loads no frontend CSS or JavaScript. Deep tracing runs only for requests made by the single selected target user while a session is active and within the configured event limit. **Known limitations** * Some plugins register admin menu pages conditionally, based on the currently logged-in administrator. Static menu inspection can therefore differ from the target user’s runtime menu. Capveriq says so instead of guessing, and recommends a Live Trace. * Custom PHP can restrict access without using WordPress capability APIs at all. Such checks are invisible to any capability-based tool, including Capveriq. * When capability state changes during `user_has_cap` processing, Capveriq reports that the state changed and lists the registered callbacks separately. It does not claim which callback was responsible. ## Installation 1. Upload the `capveriq` folder to `/wp-content/plugins/`, or install the plugin through** Plugins > Add Plugin > Upload Plugin**. 2. Activate the plugin through the **Plugins** screen in WordPress. 3. Open the **Capveriq** menu in the WordPress admin. Capveriq requires WordPress 6.4 or newer and PHP 7.4 or newer. All Capveriq screens require the `manage_options` capability. ## FAQ ### Does Capveriq change permissions? No. Capveriq is read-only for roles and capabilities. ### Does Capveriq send site information anywhere? No. Diagnostics run locally. ### What is Live Trace? Live Trace temporarily records relevant WordPress capability checks for one selected user. ### Why can a result be Inconclusive? Custom PHP can implement access checks outside standard WordPress permission APIs. Capveriq reports only evidence it can verify. ### Does it support Multisite? Yes. Capveriq detects Multisite, site membership and Super Admin context. ### Does Live Trace stay active? No. It automatically expires. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Capveriq – Permission & Access Debugger” is open source software. The following people have contributed to this plugin. Contributors * [ Muhammad Mujahid Sarfraz ](https://profiles.wordpress.org/mujahidwp/) [Translate “Capveriq – Permission & Access Debugger” into your language.](https://translate.wordpress.org/projects/wp-plugins/capveriq-permission-access-debugger) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/capveriq-permission-access-debugger/), check out the [SVN repository](https://plugins.svn.wordpress.org/capveriq-permission-access-debugger/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/capveriq-permission-access-debugger/) by [RSS](https://plugins.trac.wordpress.org/log/capveriq-permission-access-debugger/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Initial release. * Access diagnosis against core, plugin and custom admin pages. * User capability inspector with search and filters. * Role capability inspector. * Capability test tool with meta capability mapping. * Temporary Live Trace with automatic expiry and event limits. * `user_has_cap` and `map_meta_cap` observation. * Hook callback inventory with source classification. * Denied admin access logging with retention and pruning. * Multisite, Super Admin, AJAX and REST awareness. * Privacy-safe diagnostic and system reports. * Diagnostic data cleanup and optional uninstall cleanup. ## Meta * Version **1.0.1** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [access-control](https://wordpress.org/plugins/tags/access-control/)[capabilities](https://wordpress.org/plugins/tags/capabilities/) [debugging](https://wordpress.org/plugins/tags/debugging/)[permissions](https://wordpress.org/plugins/tags/permissions/) [user roles](https://wordpress.org/plugins/tags/user-roles/) * [Advanced View](https://wordpress.org/plugins/capveriq-permission-access-debugger/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/capveriq-permission-access-debugger/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/capveriq-permission-access-debugger/reviews/) ## Contributors * [ Muhammad Mujahid Sarfraz ](https://profiles.wordpress.org/mujahidwp/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/capveriq-permission-access-debugger/)