Fixed: only redirect users to the wizard with the proper capabilities.

plausible · Feb 7, 2024 · d0793f2 · d0793f2
1 parent e5b269a
commit d0793f2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/Admin/Actions.php b/src/Admin/Actions.php
@@ -59,8 +59,8 @@ public function register_assets( $current_page ) {
 	 * @return void
 	 */
 	public function maybe_redirect_to_wizard() {
-		// Make sure it only runs when requested by a browser.
-		if ( wp_doing_ajax() || wp_doing_cron() ) {
+		// Make sure it only runs when requested by (an admin in) a browser.
+		if ( wp_doing_ajax() || wp_doing_cron() || ! current_user_can( 'manage_options' ) ) {
 			return;
 		}