"Restrict access to the WordPress back-end" breaks admin-post.php form submissions

Bug Reports
1

With the “Restrict access to the WordPress back-end” setting enabled (HivePress → Users), logged-in non-admin users get redirected away before certain legitimate front-end actions can complete. Specifically, ones handled through /wp-admin/admin-post.php, which is the standard WordPress mechanism plugins use to process a logged-in user’s front-end form/action submissions (not just a dashboard page).

In our case, this breaks subscription cancellation for the WooCommerce Flexible Subscriptions plugin: the customer’s “Cancel Subscription” link points to admin-post.php?action=customer_cancel_subscription&id=..., and because that URL lives under /wp-admin/, it appears to get caught by the same restriction meant to block dashboard access. Even though it isn’t a dashboard page, just an action handler.

We’ve confirmed this is specifically the HivePress setting and not the subscription plugin: with the setting temporarily disabled, the exact same cancellation request succeeds immediately for the same non-admin account. Re-enabling it reproduces the failure reliably. We also confirmed the subscription plugin’s own code has no role/capability logic of any kind. It behaves identically for every user, and ruled out caching, Wordfence, WP Hide & Security Enhancer, and WordPress Multisite’s own user-membership checks before landing on this.

Steps to reproduce

  1. Enable HivePress > Users > “Restrict access to the WordPress back-end.”
  2. Log in as a non-admin user with an active WooCommerce subscription (we’re using Flexible Subscriptions, but this likely affects any plugin using the same admin-post.php pattern).
  3. Trigger a front-end action that submits to admin-post.php, in our case, clicking “Cancel Subscription.”

Actual result

The request is redirected away (in our case, to a HivePress account page) before the action’s own handler ever runs. We confirmed via a full WordPress hook trace that the action responsible for processing the request (admin_post_customer_cancel_subscription) never fires at all for the non-admin user, it fires normally for an admin account on the identical flow. The subscription is never cancelled.

Expected result

The restriction should only block access to actual /wp-admin/ dashboard pages, and allow legitimate admin-post.php action requests (or admin-ajax.php-style front-end action handling generally) through, the same way admin-ajax.php requests are typically excluded from this kind of restriction elsewhere, since both are standard mechanisms for handling logged-in front-end actions rather than dashboard access.

Extra details

  1. Environment: WordPress Multisite
  2. Plugins involved: HivePress + HivePress Memberships
  3. Third-party plugin whose action gets blocked: WooCommerce + Flexible Subscriptions (subscription management). But based on the mechanism, this seems likely to affect any plugin relying on the standard admin-post.php front-end action pattern, not just this one.
3

Hi,

Thanks for the detailed bug report – we’ll try to exclude files needed for the form submissions in the next update. Please also consider reporting this to the subscriptions plugin developer, as front-end forms shouldn’t post to /wp-admin/* files in any case, the modern way to handle form submissions is via a REST API endpoint.

As a temporary workaround, we can provide a code snippet to redirect the admin pages for non-admins, which would also allow disabling the “Restrict access…” option – let me know.

4

Thanks @ihor,

Yes I will definitely share that with that plugin’s developer so they can make some changes on their end as well. I agree, It does feel strange that the end user’s form is using /wp-admin/to submit a form.

And yes please if you can share temporary code snippet for bypassing this in the time being, that would be great.

Thanks you!