[Resolved] Shock! A subscriber can admin the Jetpack options!
I am using Jetpack 2.0.2.
I created a new user in WordPress and gave him the subscriber role which has only the “read” capability. Then, I logged in as this user. I got an admin page with Dashboard and Profile, and guess what? The Jetpack admin page appeared, too, happily saying:
“To enable all of the Jetpack features you’ll need to link your account here to your WordPress.com account using the button to the right.”
Folks, not every user should be able to change the Jetpack settings on my site! Would you please fix this? Please check for the manage_options capability first before you show the Jetpack admin panel:
Thanks a lot!
- The topic ‘[Resolved] Shock! A subscriber can admin the Jetpack options!’ is closed to new replies.