[Remi K.]

Hi,

I noticed that the latest Shortcoder release includes this change in the changelog:

> “Fix: Select and insert shortcode popup is available only for administrators”

In the previous version, users with the edit_posts capability could use the Shortcoder insert/browse functionality. The new version changes this to manage_options, effectively restricting the feature to administrators on a standard WordPress installation.

Could you reconsider this restriction, or provide a filter/capability that site administrators can use to control who is allowed to access the Shortcoder popup?

There are many WordPress sites where editors or other trusted roles are intentionally allowed to create/edit content without having administrator privileges. Being able to insert existing Shortcoder shortcodes into posts is a content-editing function, so requiring manage_options seems unnecessarily restrictive.

Ideally, something like a dedicated manage_shortcoder capability, or a filter around the capability check, would allow site owners to decide which roles can use the feature while preserving the administrator-only default if that is the security concern.

For reference, this appears to be the relevant change in admin/tools.php:

`php
if ( ! current_user_can( ‘manage_options’ ) ) {
return;
}
`

and the same capability is now required for the shortcode browse/insert popup.

Could you please consider exposing this as a configurable capability rather than hard-coding manage_options?

Thanks!

[Aakash]

Hi Remi,

Thanks for using Shortcoder.
Yes it was requested by security researchers hence I have made those changes.

Sure I’ll consider adding an option in the next version of the plugin which is targetted for WordPress 7.1

Thanks,
Aakash

[Author]

Posts