Analyzing "You do not have sufficient permissions to access this page" error in WP admin

June 18, 2020 – Tested with WP 5.4.2.

March 23, 2018 – Updated the default value for wp_user_roles from WP 4.9.4. Everything else in this post still applies.

---

Recently, a client came to us with a problem – they were suddenly unable to log in to their WordPress/WooCommerce site.

Even when logged in as Administrator, You do not have sufficient permissions to access this page error message was displayed and it was not possible to navigate to any page in wp-admin – even the account’s profile page. This symptom indicates that WP cannot find the roles and permissions of your account from the database – so it assumes you don’t have any permissions at all.

The most typical cause for this problem is the database prefix setting. In wp-config.php, it looks like this:

/**
 * WordPress Database Table prefix.
 *
 * You can have multiple installations in one database if you give each a unique
 * prefix. Only numbers, letters, and underscores please!
 */
$table_prefix = 'wp_';

Some developers change the DB prefix for various reasons (which I’ll not discuss in this post). When this is done during the installation process, it shouldn’t cause any problems. However, when migrating your site or changing the DB prefix after installation, there’s a chance to break something. This is because the field titled “Database Table Prefix” is actually not only for table prefixes, but also for some field prefixes. For example, each account’s capabilities (i.e. permissions) are stored in [$table_prefix]usermeta table on the row where meta_key is [$table_prefix]capabilities.

So if your table prefix is “ASD_” then that table row’s meta key is not ‘wp_capabilities’ but ‘ASD_capabilities’.

The same applies for quite a few other usermeta fields, options fields, etc.

 

However, in my case this was not the problem. I reviewed the db table fields and everything looked fine. So the next step in debugging the problem was disabling all plugins – the client had installed some suspicious plugins from CodeCanyon and I assumed they were causing this issue. But this didn’t give me any results either.

Next, I wanted to make sure that it actually is an issue with the database, so I wrote a simple function which filters all capability checks and returns true.

// This goes to your theme's functions.php
function codelight_all_permissions( $allcaps, $cap, $args ) {
    $allcaps[$cap[0]] = true;
    return $allcaps;
}
add_filter( 'user_has_cap', 'codelight_all_permissions', 0, 3 );

After adding this code to the theme, I was able to log in, which confirmed my suspicion that it was an issue with the database. A quick look in WP admin revealed that something had deleted all user roles and there was only one role remaining (which was called something like Wholesale Customer).

In order to restore the default roles, I re-added the default content to wp_options table, wp_user_roles option (this has not changed between WP v4.9.x and v5.4.x)

a:5:{s:13:"administrator";a:2:{s:4:"name";s:13:"Administrator";s:12:"capabilities";a:61:{s:13:"switch_themes";b:1;s:11:"edit_themes";b:1;s:16:"activate_plugins";b:1;s:12:"edit_plugins";b:1;s:10:"edit_users";b:1;s:10:"edit_files";b:1;s:14:"manage_options";b:1;s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:6:"import";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:8:"level_10";b:1;s:7:"level_9";b:1;s:7:"level_8";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;s:12:"delete_users";b:1;s:12:"create_users";b:1;s:17:"unfiltered_upload";b:1;s:14:"edit_dashboard";b:1;s:14:"update_plugins";b:1;s:14:"delete_plugins";b:1;s:15:"install_plugins";b:1;s:13:"update_themes";b:1;s:14:"install_themes";b:1;s:11:"update_core";b:1;s:10:"list_users";b:1;s:12:"remove_users";b:1;s:13:"promote_users";b:1;s:18:"edit_theme_options";b:1;s:13:"delete_themes";b:1;s:6:"export";b:1;}}s:6:"editor";a:2:{s:4:"name";s:6:"Editor";s:12:"capabilities";a:34:{s:17:"moderate_comments";b:1;s:17:"manage_categories";b:1;s:12:"manage_links";b:1;s:12:"upload_files";b:1;s:15:"unfiltered_html";b:1;s:10:"edit_posts";b:1;s:17:"edit_others_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:10:"edit_pages";b:1;s:4:"read";b:1;s:7:"level_7";b:1;s:7:"level_6";b:1;s:7:"level_5";b:1;s:7:"level_4";b:1;s:7:"level_3";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:17:"edit_others_pages";b:1;s:20:"edit_published_pages";b:1;s:13:"publish_pages";b:1;s:12:"delete_pages";b:1;s:19:"delete_others_pages";b:1;s:22:"delete_published_pages";b:1;s:12:"delete_posts";b:1;s:19:"delete_others_posts";b:1;s:22:"delete_published_posts";b:1;s:20:"delete_private_posts";b:1;s:18:"edit_private_posts";b:1;s:18:"read_private_posts";b:1;s:20:"delete_private_pages";b:1;s:18:"edit_private_pages";b:1;s:18:"read_private_pages";b:1;}}s:6:"author";a:2:{s:4:"name";s:6:"Author";s:12:"capabilities";a:10:{s:12:"upload_files";b:1;s:10:"edit_posts";b:1;s:20:"edit_published_posts";b:1;s:13:"publish_posts";b:1;s:4:"read";b:1;s:7:"level_2";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;s:22:"delete_published_posts";b:1;}}s:11:"contributor";a:2:{s:4:"name";s:11:"Contributor";s:12:"capabilities";a:5:{s:10:"edit_posts";b:1;s:4:"read";b:1;s:7:"level_1";b:1;s:7:"level_0";b:1;s:12:"delete_posts";b:1;}}s:10:"subscriber";a:2:{s:4:"name";s:10:"Subscriber";s:12:"capabilities";a:2:{s:4:"read";b:1;s:7:"level_0";b:1;}}}

.. which fixed the issue.

In the end, I suspect one of the Codecanyon plugins deleted all WP roles, but I didn’t bother figuring out the exact reason – the plugins contained 5000+ lines of very similar code with minor variations so it was rather difficult to read and not worth the time.