Title: Wrong capability check (edit_posts)
Last modified: August 13, 2026

---

# Wrong capability check (edit_posts)

 *  Resolved [julienlusson](https://wordpress.org/support/users/julienlusson/)
 * (@julienlusson)
 * [3 weeks, 1 day ago](https://wordpress.org/support/topic/wrong-capability-check-edit_posts/)
 * Hi, the plugin has a bug, it checks for “edit_post” capability but it’s “edit_posts”:
 * > [Roles and Capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/)

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Plugin Support [Adrian](https://wordpress.org/support/users/adrianrus/)
 * (@adrianrus)
 * [3 weeks, 1 day ago](https://wordpress.org/support/topic/wrong-capability-check-edit_posts/#post-18992224)
 * Hi [@julienlusson](https://wordpress.org/support/users/julienlusson/) ,
 * Thank you for your message and for using our plugin! 🙂
 * In this case it isn’t a bug: `edit_post` and `edit_posts` are two different capabilities
   in WordPress, and the plugin is using the right one for this check.
    - **`edit_posts`** is a _primitive_ capability, used without arguments, `current_user_can('
      edit_posts')` meaning “can this user edit posts in general?”
    - **`edit_post`** is a _meta_ capability. It takes an object ID, `current_user_can('
      edit_post', $post_id)` meaning “can this user edit _this particular_ post?”
      WordPress resolves it at runtime through `map_meta_cap()` into the appropriate
      primitive capabilities (`edit_posts`, `edit_others_posts`, `edit_published_posts`,
      etc.) based on that post’s author and status.
 * Enable Media Replace calls it as `current_user_can('edit_post', $post_id)` with
   the attachment ID, so it’s the meta capability and the usage is correct.
 * The Roles and Capabilities page you linked documents the capabilities assigned
   to roles; it doesn’t cover meta capabilities like `edit_post`. Those are documented
   with `map_meta_cap()`: [https://developer.wordpress.org/reference/functions/map_meta_cap/](https://developer.wordpress.org/reference/functions/map_meta_cap/)
 * Changing it to `edit_posts` would actually weaken the check. It would only confirm
   the user can edit posts somewhere, dropping the per-attachment ownership check,
   so a Contributor could pass it for another user’s media. The singular form with
   the ID is the stricter behaviour, which is what we want here.
 * I hope it makes more sense now!
 * All the best,
 *  Thread Starter [julienlusson](https://wordpress.org/support/users/julienlusson/)
 * (@julienlusson)
 * [3 weeks ago](https://wordpress.org/support/topic/wrong-capability-check-edit_posts/#post-18993434)
 * Hi [@adrianrus](https://wordpress.org/support/users/adrianrus/),
 * Thanks for your answer.
 * My bad, I was testing with an account without the “edit_other_posts” capability
   and no media in the library from this user, so it was working as intended and
   it’s not a bug.
 * I don’t want the user to make “Posts” elements but use only “Pages” to create
   WordPress webpages. But the catch is that WordPress capabilities are quite limited
   for that: *_posts capabilities are both for “Posts” and “Media”, so we can’t 
   only block post or media with “capabilities”.
 * Now, I’ve blocked the access to “post” creation with other means and added the“
   edit_other_posts” cap to the user and now your plugin work well.
 * With another plugin, the media replacement of other media files was working without
   the 
   “edit_other_posts” capability, but now, I see that’s quite a flaw of the
   other plugin.
 * Regards
 *  Plugin Support [Adrian](https://wordpress.org/support/users/adrianrus/)
 * (@adrianrus)
 * [3 weeks ago](https://wordpress.org/support/topic/wrong-capability-check-edit_posts/#post-18993449)
 * Hi [@julienlusson](https://wordpress.org/support/users/julienlusson/) ,
 * No worries at all and thanks for coming back to confirm! Glad it turned out to
   be working as intended! 🙂
 * As for the other plugin, yes, a per-object ownership check is generally the safer
   way.
 * All the best,

Viewing 3 replies - 1 through 3 (of 3 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fwrong-capability-check-edit_posts%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/enable-media-replace/assets/icon-256x256.png?rev=1940728)
 * [Enable Media Replace](https://wordpress.org/plugins/enable-media-replace/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/enable-media-replace/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/enable-media-replace/)
 * [Active Topics](https://wordpress.org/support/plugin/enable-media-replace/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/enable-media-replace/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/enable-media-replace/reviews/)

 * 3 replies
 * 2 participants
 * Last reply from: [Adrian](https://wordpress.org/support/users/adrianrus/)
 * Last activity: [3 weeks ago](https://wordpress.org/support/topic/wrong-capability-check-edit_posts/#post-18993449)
 * Status: resolved