1

Users connected with the "subscriber" role in WordPress do not see CiviCRM nor access to it (404 error). It works well with WP admin role. I believe I have configured correctly the permissions in Administer -> Users & Permissions -> WordPress Access Control. Any ideas? Many thanks

  • Can you check if the url doesn't have wp-admin/admin.php? – Pradeep Nayak Aug 9 '19 at 10:48
  • What version of CiviCRM are you using? And did it work until you did an update? – Jon G - Megaphone Tech Aug 9 '19 at 16:20
  • 2
    Also, you said "I believe I have configured correctly the permissions" - can you please edit your question to tell us (and/or use a screenshot) to show us the permissions? – Jon G - Megaphone Tech Aug 9 '19 at 16:24
  • @ Pradeep: as told in my question, admin role can access CiviCRM so admin.php is there @ Jon: I use version Version 5.14.1, first version installed (I will update it on the next days) I have configured correctly the permissions in Administer -> Users & Permissions -> WordPress Access Control as you can see: !Valid XHTML. – Patrick Aug 12 '19 at 16:07
  • Could you clarify what level of access you want subscribers to have? This isn't clear from your question. – William Mortada Sep 22 '19 at 10:56
0

After having tested all the possibilities by checking and unchecking all the options marked in the WordPress Access Control pane, I found that the box "CiviCRM: access CiviCRM backend and API" must be be ticked. Otherwise you dont have access to CiviCRM. Strange because it is told to give this to trusted roles only. The well done documentation is unfortunately lacking on this subject.

| improve this answer | |
  • I wouldn't normally recommend giving subscribers this level of access to CiviCRM. What do you want subscribers to be be able to do on your site? You can find the documentation here: docs.civicrm.org/user/en/latest/initial-set-up/… – William Mortada Sep 22 '19 at 10:55
  • The subscriber should be able to do what a "normal user" can do in a NP organisation : create, modify, delete and use contacts. – Patrick Sep 23 '19 at 9:37
  • The 'subscriber' role in WordPress is typically used to allow people to sign up to receive information from a website. It doesn't normally give them permission to access any admin functions or the WordPress dashboard. Perhaps you are using this role in a different way but it sounds like an unusual set up. As it says in the manual the permission to access the CiviCRM back end should only be given to trusted roles and I wouldn't recommend giving it to anyone outside the staff team. – William Mortada Sep 23 '19 at 10:06
  • If you are using the role for staff I would be inclined to use one of the other WordPress roles that typically have greater access such as 'administrator' or 'editor'. Alternatively you could create a new role for this purpose. This page that explains roles and permissions may help: wordpress.org/support/article/roles-and-capabilities – William Mortada Sep 23 '19 at 10:10
  • Thank you William, I fully understand what you mean, but... this doesn't explain why I need to give the " "CiviCRM: access CiviCRM backend and API" to see CiviCRM menu. The problem will be the same with all other roles... According me, this is a weakness in the security of CiviCRM under WP. – Patrick Sep 23 '19 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.