Hi,
First of all, WPForo is an awesome plugin with a lot of functionality. 🙂
I started testing it today with some of my friends and there are a few issues that I am facing. For example, any user who registers through WPForo ends up showing under "All Users" in the admin panel of my website.
Is this expected behavior or something is wrong? Attaching a screenshot for reference.
The user marked with green should be the only one present as that's the admin.
Thanks Sofy. 🙂
Does this mean that what I am seeing in my Admin section is perfectly safe and normal?
Is there any kind of security risk that I might face due to this? Will the registered users be able to access the Admin panel?
I can also see the option to edit information about a particular user by clicking on the "Edit" button as shown in the attached image.
This allows me to change everything related to a user like their first name, last name, email id etc. Is this normal as well?
Hi WPForoNoob,
Is there any kind of security risk that I might face due to this? Will the registered users be able to access the Admin panel?
You've started using WordPress and you should know that all plugins of WordPress based on WordPress functions and features. The main system used by all plugins is the user and user authorization system. There is no way to create a WordPress plugin without using WordPress user system. If you don't use WordPress user system then the plugin is not a WordPress plugin. All registered users become WordPress users with subscriber role. The database of users is the same for all plugins and for WordPress so you see all users in one place, in dashboard > users admin page.
But there are lots of different between your account and other regular registered users. They have different roles and permissions. WordPress made this absolutely safe, thus all WordPress sites in web allow user registration without any worry. When user access to dashboard he only see profile management fields (username, firstname, etc), nothing else is allowed to registered users. The screenshot of a registered user dashboard:
Users can open this page using to top black bar. WordPress displays this bar for all registered users. However this bar doesn't have all menus like it's for admin user. It looks like this:
wpForo disables the top black bar for non-admin users by default. It has an option to disable it in Dashboard > Forums > Settings > Features admin page:
However some advanced WordPress users may access to this safe page using direct URL. To stop any accesses to the dashboard profile page you can use this plugin (this has not been updated long time, because it doesn't need any changes. it works just fine): https://wordpress.org/plugins/wp-admin-no-show/
I can also see the option to edit information about a particular user by clicking on the "Edit" button as shown in the attached image. This allows me to change everything related to a user like their first name, last name, email id etc. Is this normal as well?
Yes, This is normal.This is the regular WordPress function to manage users. The main idea why users are listed in dashboard is allowing admins to manage them, delete, edit, etc... This is also provided by wpForo in Dashboard > Forums > Members admin page.
