Is your feature request related to a problem? Please describe
In WordPress Multisite environments, site-level administrators can access the Code Snippets plugin due to the manage_options capability. This allows them to create and execute arbitrary PHP code, which can pose risks in certain setups.
Describe the solution you'd like
Introduce a way to restrict PHP snippet execution in Multisite environments, for example:
- A network-wide setting (Super Admin only) to disable PHP snippets
- Option to allow only CSS/JS snippets for site admins
- Capability-based control to limit who can run PHP snippets
- Optional per-site override (if needed)
Describe alternatives you've considered
No response
Additional context
https://wordpress.org/support/topic/php-and-security/
Is your feature request related to a problem? Please describe
In WordPress Multisite environments, site-level administrators can access the Code Snippets plugin due to the manage_options capability. This allows them to create and execute arbitrary PHP code, which can pose risks in certain setups.
Describe the solution you'd like
Introduce a way to restrict PHP snippet execution in Multisite environments, for example:
Describe alternatives you've considered
No response
Additional context
https://wordpress.org/support/topic/php-and-security/