| @@ -202,8 +202,16 @@ | ||
| 202 | 202 | // user inside the right module. WordPress's add_submenu_page |
| 203 | 203 | // strips the hash, so we inject directly into $submenu where |
| 204 | 204 | // it survives intact (the same trick Yoast / WooCommerce use |
| 205 | 205 | // for their per-area shortcuts). |
| 206 | + // | |
| 207 | + // Writing to $submenu skips the capability check add_submenu_page() | |
| 208 | + // does, and core keeps a top-level item the user can't open while its | |
| 209 | + // submenu has entries. Without this guard an Editor saw an empty | |
| 210 | + // "xSpeed Cache" flyout that led to a permissions error. (#720) | |
| 211 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 212 | + return; | |
| 213 | + } | |
| 206 | 214 | global $submenu; |
| 207 | 215 | $deep_links = self::deep_link_items(); |
| 208 | 216 | foreach ( $deep_links as $hash => $label ) { |
| 209 | 217 | $submenu[ self::PAGE_SLUG ][] = array( |
