Restrict “Export” for users with list_users capability

Hi,

Good news — this is now built into the plugin as of version 2.5, and your case is exactly why we changed it.

Previously, the Export tab and the Import tab shared the same permission check (acui_capability, default create_users). If you had already added a filter to make it accept add_users so your import-only role could work, that same filter was also opening up Export — there was no way to separate the two.

In 2.5, Export now has its own independent filter, acui_export_capability, decoupled from acui_capability. By default it requires edit_users rather than list_users — we went with edit_users because the CSV export can include arbitrary custom meta fields (addresses, phone numbers, etc.), not just the columns shown on the Users list screen, so edit_users (the capability WordPress itself uses to let someone open another user’s full profile) matches that level of data exposure more closely than list_users does.

That said, it’s fully filterable, so you can set it to exactly list_users as you asked:

// Import: your role only needs add_users
add_filter( 'acui_capability', function( $cap ) {
    return 'add_users';
} );

// Export: require list_users instead of the edit_users default
add_filter( 'acui_export_capability', function( $cap ) {
    return 'list_users';
} );

With that, your import-only role (with add_users but no list_users/edit_users) will be able to use Import, but the Export tab, its nav link, and the export/download endpoints will all be blocked for it — even if it somehow reaches the URL directly.

Let me know if you’d like a hand wiring this into your custom role setup.

Thanks to you! If you like our plugin please rate us!