Title: Execute admin script/action on front-end event
Last modified: August 31, 2016

---

# Execute admin script/action on front-end event

 *  Resolved [Ab C](https://wordpress.org/support/users/achoudharygmailcom/)
 * (@achoudharygmailcom)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/)
 * When a front-end user (role: Subscriber) performs a certain action (click a button,
   for example), I need a new post to be created. Now I can call wp_insert_post 
   in the page template I’m using but the Subscriber role does not have permission
   to create a post (in published state). Other than giving the subscriber a higher
   role, are there any other options?
 * I was wondering if I can simply invoke an admin action from the page template
   that will publish a new post. Is there any way to change the user context (to
   author or up) before calling wp_insert_post? This needs to be done programmatically.
 * Thanks in advance,
    Aj

Viewing 6 replies - 1 through 6 (of 6 total)

 *  [Bob Cristello](https://wordpress.org/support/users/gntmidnight/)
 * (@gntmidnight)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397417)
 * I suppose you could use a plugin like the Capability Manager and just give permissions
   to the subscriber to create posts if that is what you really need.
 * [https://wordpress.org/plugins/capability-manager-enhanced/](https://wordpress.org/plugins/capability-manager-enhanced/)
 * The Contributor can create posts but they can’t publish them. Authors can create,
   edit and delete their own posts. Here is a breakdown of the default user roles.
 * [http://www.wpbeginner.com/beginners-guide/wordpress-user-roles-and-permissions/](http://www.wpbeginner.com/beginners-guide/wordpress-user-roles-and-permissions/)
 *  Thread Starter [Ab C](https://wordpress.org/support/users/achoudharygmailcom/)
 * (@achoudharygmailcom)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397448)
 * I tried a plugin but it required changes per user. This one seems like it will
   work. I’ll try it out.
 * The side effect of these plugins is that it provides access to /wp-admin, which
   is what I’m trying to avoid.
 * Thanks for your help,
    Aj
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397574)
 * PHP runs under the privileges assigned to the server user it’s running as, the
   server user has nothing to do with WP users. As such, PHP can pretty much do 
   anything it wants within the WP environment, including publishing new posts. 
   If you call `wp_insert_post()` on a page template with the proper parameters,
   a post will be inserted. It doesn’t matter what user requested the page, they
   don’t even need to be logged in.
 * Bear in mind that once a user sees a page, the template code for that page has
   already executed. If the user should click a button to insert a post, the success
   depends on what that button click does. The page in a browser cannot execute 
   PHP directly, only the server can do that.
 * If the button click invokes an XML-RPC call, proper user credentials need to 
   be supplied for success. If the click loads another page, what happens depends
   on the code that executes for _that_ page. If that page’s template calls `wp_insert_post()`,
   a post will be inserted, regardless of user or if they are logged in. Unless 
   you like filling up your DB with spam posts, this is not the way to insert posts
   🙂
 * A good approach would be to have the button click make an AJAX request that causes
   the server to insert a published or draft post(your choice). The PHP AJAX handler
   should verify the request includes a security nonce to ensure the request is 
   from a legitimate source. The handler should also confirm the current user has
   the proper role to publish posts as determined by you, it does not need to involve
   a ‘publish_posts’ capability because PHP is running with full privileges. To 
   prevent spam posts, at the very least ensure the user is logged in.
 * AJAX in WP is a bit different than generic AJAX. More on AJAX in the WP environment:
   [https://developer.wordpress.org/plugins/javascript/ajax/](https://developer.wordpress.org/plugins/javascript/ajax/)
 *  Thread Starter [Ab C](https://wordpress.org/support/users/achoudharygmailcom/)
 * (@achoudharygmailcom)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397575)
 * Great. Thanks for your feedback.
 * I was getting an “Illegal string offset for post_type” error. This threw me off
   completely with permissions to create posts. Turns out the error was related 
   to a plugin (Leaky Paywall) that we are using. I haven’t been able to figure 
   out why it is being thrown but I was tracking errors and so could not proceed.
 * My issues are not resolved.
 * Thanks again,
    Aj
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397592)
 * Perhaps you are already aware of the usual cause of that error (actually warning
   IIRC), but here it is anyway. It is often caused by either a type mismatch or
   the variable not being set at all. The fault could lie elsewhere and the plugin’s
   only fault is not being robustly coded and just assuming a variable is set without
   checking. This is particularly important when relying on data from outside sources.
   For example, this code is weak:
    `if ('post' == $post_type ) //...` This is better:`
   if ( isset( $post_type ) && 'post' == $post_type ) //...`
 * One solution would be to improve the plugin’s code to be more robust, but the
   problem could recur when the plugin updates and your improvement is overwritten.
   Additionally, the code could fail in other ways when the code depending on post_type
   is not executed.
 * Ideally, determine why the plugin is not getting the data it expects and fix 
   it. Good luck!
 *  Thread Starter [Ab C](https://wordpress.org/support/users/achoudharygmailcom/)
 * (@achoudharygmailcom)
 * [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397607)
 * Didn’t know this. Thanks again!

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Execute admin script/action on front-end event’ is closed to new replies.

 * In: [Hacks](https://wordpress.org/support/forum/plugins-and-hacks/hacks/)
 * 6 replies
 * 3 participants
 * Last reply from: [Ab C](https://wordpress.org/support/users/achoudharygmailcom/)
 * Last activity: [10 years, 2 months ago](https://wordpress.org/support/topic/execute-admin-scriptaction-on-front-end-event/#post-7397607)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics