Capability reference

The role editor describes every capability. This page lists WordPress's own, with the roles that have them on a new WordPress site (A = Administrator, E = Editor, Au = Author, C = Contributor, S = Subscriber).

Posts

Capability	Allows	Roles
edit_posts	Write posts and edit their own drafts; opens the Posts screen	A E Au C
edit_others_posts	Edit posts written by other people	A E
edit_published_posts	Edit their own posts once published	A E Au
edit_private_posts	Edit private posts	A E
publish_posts	Publish and schedule posts (without it, posts go to review)	A E Au
delete_posts	Delete their own unpublished posts	A E Au C
delete_others_posts	Delete other people's posts	A E
delete_published_posts	Delete their own published posts	A E Au
delete_private_posts	Delete private posts	A E
read_private_posts	Read private posts	A E
manage_categories	Add, edit and delete categories and tags	A E

Pages

The same set for pages: edit_pages, edit_others_pages, edit_published_pages, edit_private_pages, publish_pages, delete_pages, delete_others_pages, delete_published_pages, delete_private_pages, read_private_pages. Administrators and editors have them all.

Media and comments

Capability	Allows	Roles
upload_files	Upload files and use the Media Library	A E Au
unfiltered_upload	Upload any type of file, including ones WordPress blocks	(none by default)
moderate_comments	Approve, edit, spam and delete comments	A E

Users

Capability	Allows	Roles
list_users	See the Users screen	A
create_users	Add users	A
edit_users	Edit other users' profiles, including email and password	A
delete_users	Delete users	A
promote_users	Change users' roles	A
remove_users	Remove users from the site	A

Plugins and themes

Capability	Allows	Roles
activate_plugins	See Plugins; activate and deactivate them	A
install_plugins, update_plugins, delete_plugins	Install, update and delete plugins	A
edit_plugins	Edit plugin code in the editor	A
switch_themes	Change the theme	A
edit_theme_options	Customizer, Site Editor, menus and widgets	A
install_themes, update_themes, delete_themes	Install, update and delete themes	A
edit_themes	Edit theme code in the editor	A

Settings and core

Capability	Allows	Roles
read	Log in, see the dashboard and edit their own profile	all
manage_options	Every setting under Settings: in practice, full control	A
import, export	Tools → Import and Export	A
update_core	Update WordPress	A
edit_files	Edit files on the server (used by the file editors)	A
unfiltered_html	Post any HTML and JavaScript	A E
edit_dashboard	Change the dashboard's widgets	A
manage_links	The old Links screen	A E

On multisite, super admins have every capability, and unfiltered_html, edit_plugins, edit_themes and similar are for super admins only.

Capabilities that need care

Roleline asks you to confirm before giving these to a role other than Administrator, because anyone with them could take over the site: manage_options, promote_users, edit_users, create_users, delete_users, remove_users, activate_plugins, install_plugins, edit_plugins, delete_plugins, update_plugins, install_themes, edit_themes, delete_themes, switch_themes, update_core, edit_files, unfiltered_html, unfiltered_upload, import, the network capabilities, roleline_manage_roles and manage_woocommerce. Developers can change the list with the roleline_risky_capabilities filter.

WooCommerce

WooCommerce adds manage_woocommerce (its settings, orders and reports), view_woocommerce_reports, and for products, orders, coupons and webhooks the same set as posts (edit_products, edit_others_shop_orders, assign_product_terms…). Its Shop Manager role has them. Roleline lists them under WooCommerce, with descriptions, even while WooCommerce is inactive.