Contributors can bulk delete spam?

Indeed.

Actually I think the bulk delete is ok, but the “Delete All Spam” is not. Bulk delete has a “can-edit-post” check against it.

I disagree, Contributors write and edit draft posts, nothing else, they shouldn’t even be able to see the spam comments, nor any of the comments pages, nothing to do with their role.

I’ve added a patch to the trac which changes the capability check in the menu from edit_posts to moderate_comments, effectively removing it for contributors. I think that makes more sense, but it’ll be up to the core devs if they want to adopt it. Nothing to stop you applying the patch to your own install, of course ??

I’m a newb who is a little confused.

It looks to me like contributors have permission to bulk delete all posts – Regardless of who posted them.

Is this true?

If so, is there a way to remove this permission?

Seems a little dangerous for each contributor to have the ability to destroy all posts at once. Hope you don’t make them angry!

Hi,

You can edit the permissions of your user role with this plugin:

https://www.dealsway.net/plugins/wp-user-manager
https://www.ads-software.com/extend/plugins/user-access-manager/

Also check with this plugin:
https://sourceforge.net/projects/role-manager/

Refer this article too:
https://codex.www.ads-software.com/Roles_and_Capabilities

Thanks,

Shane G.