User roles and permissions in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user with the 'Editor' role tries to delete a published post?

In WordPress, users have different roles with specific capabilities. Consider a user assigned the 'Editor' role. What will happen if this user attempts to delete a published post?

A The user cannot delete any posts at all.

B The user cannot delete published posts, only drafts or their own posts.

C The user can delete the published post without restrictions.

D The user can delete only posts they authored, not posts by others.

💡 Hint

Think about the default capabilities assigned to the Editor role in WordPress.

Editors have the capability to delete published posts, but only those they authored. They cannot delete published posts by other authors.

📝 Syntax

intermediate

Which code snippet correctly adds a custom capability to the 'Author' role?

You want to add a custom capability named 'edit_special_content' to the 'Author' role in WordPress. Which code snippet does this correctly?

A $role = get_role('author'); $role->add_cap('edit_special_content');

B $role = get_role('Author'); $role->add_cap('edit_special_content');

C get_role('Author')->add_cap('edit_special_content');

D add_cap('Author', 'edit_special_content');

💡 Hint

Remember that role slugs are lowercase and you need to get the role object before adding capabilities.

The correct way is to get the role object with the exact slug 'author' (lowercase), then call add_cap on it.

❓ state_output

advanced

What is the output of this code when checking if a user can 'publish_posts'?

Consider the following code snippet executed in a WordPress environment where the current user has the 'Contributor' role:

if (current_user_can('publish_posts')) {
  echo 'Can publish';
} else {
  echo 'Cannot publish';
}

What will be printed?

Wordpress

if (current_user_can('publish_posts')) {
  echo 'Can publish';
} else {
  echo 'Cannot publish';
}

A Cannot publish

B Can publish

C Fatal error: function current_user_can() not found

D No output

💡 Hint

Check the default capabilities of the 'Contributor' role regarding publishing posts.

Contributors can write and edit their own posts but cannot publish them. So current_user_can('publish_posts') returns false.

🔧 Debug

advanced

Why does this code fail to add a capability to a custom role?

Given this code snippet, why does the custom capability not get added to the 'custom_role'?

add_action('init', function() {
  $role = get_role('custom_role');
  $role->add_cap('manage_special_feature');
});

Wordpress

add_action('init', function() {
  $role = get_role('custom_role');
  $role->add_cap('manage_special_feature');
});

A The capability name 'manage_special_feature' is reserved and cannot be added.

B The 'init' hook runs too early before roles are registered.

C The 'custom_role' does not exist, so get_role returns null causing an error.

D add_cap() requires a second parameter to enable the capability.

💡 Hint

Check if the role 'custom_role' exists before adding capabilities.

If 'custom_role' is not registered before this code runs, get_role returns null. Calling add_cap on null causes failure.

🧠 Conceptual

expert

How does WordPress determine if a user can perform a specific action?

Explain the process WordPress uses internally to decide if a user has permission to perform an action like 'edit_post'. Which of the following best describes this process?

A WordPress checks the user's role and matches it exactly to the action name.

B WordPress checks the user's capabilities, which are assigned to roles or directly to users, to see if the capability required for the action is present.

C WordPress checks if the user is an administrator; if not, all actions are denied.

D WordPress uses the user's username to look up permissions in the database for each action.

💡 Hint

Think about how roles and capabilities relate to permissions.

WordPress uses capabilities assigned to roles or users to determine permissions. Actions require specific capabilities, and current_user_can() checks these.