I'm running Civi (v.5.13) in a multisite/multidomain configuration hosted in a WordPress (v.5.2) multisite network. Each WP child site has its own Civi domain ID. The CiviCRM Multisite extension is enabled.
I'm trying to use a Civi profile embedded in WP child site page as a simple contact search form with a limited set of fields. The search results should only show contacts associated with the Civi domain for that WP child site. Instead, the search form returns search results for contacts across all Civi domains, not just the current one.
In contrast, when a WordPress user with appropriate Civi access permissions logs in to the WP child site and searches for contacts through the normal Civi contacts search, only the contacts in their own Civi domain are accessible to them, as expected.
Playing with Civi permissions, I've found that the user either needs
profile_listings permission, or the Profile needs a
Search operation ACL to work, or the Profile page returns a permission denied error. I've also experimented with CiviCRM Multisite extension
view_all_contacts_in_domain permission, but adding or removing this does not change the behavior. The user does not have the
Is there a way to make the Civi Profile form enforce the Civi domain restrictions?