WooCommerce bulk editor shop manager forbidden: roles and permissions

When a shop manager types a new price into the WooCommerce bulk editor and the cell answers forbidden, the shop manager is not missing a WordPress capability. BEAR has its own field rules for every role except administrator, and those rules do not allow that field yet. Below is how BEAR decides who may open it and who may change which field, how to read the symptom, and how to give a role exactly the access it needs, restrict it, or share one setup with the whole team.

Two checks: who may open BEAR, and who may edit a field

The first check is WordPress access. The BEAR Bulk Editor page under Products is registered for the manage_woocommerce capability, which Administrator and Shop Manager have by default, and every request the editor sends (saving a cell, a bulk run, deleting, loading profiles) checks it again. Requests that change products also check that the user may edit each of those products in WordPress terms. A role without edit_others_products can therefore change only the products it authored. When this check fails, nothing is saved and the edited cell shows 0.

The second check is BEAR's field rule. The roles in the woobe_permit_special_roles list, which holds only administrator by default, may edit every field. Every other role that can open the editor, Shop Manager and any custom role alike, may edit only the fields an administrator has marked visible for the shop manager in the Settings tab. A save of any other field is refused, and the cell shows forbidden.

Older forum answers say the user needs manage_options. The current version does not check manage_options for editing at all. Giving a shop manager that capability opens the WordPress settings screens to them and does not change the field rules, so do not do it to fix a forbidden answer.

Read the symptom: what forbidden and 0 mean

The general causes of edits that do not save (the Enter key, binded editing, firewalls, caching) are in WooCommerce bulk editor changes not saving.

Let shop managers edit the columns they need

This is the intended way and needs no code.

1. Log in as an administrator and open the Settings tab of the editor. Under every column there is a visible for the shop manager checkbox. Only administrators see it.
2. Tick it under the columns the role should see and edit, untick it under the rest. For stock work tick Manage stock, Stock quantity and Stock status together: a quantity entered on a product with stock management off is discarded by WooCommerce when the product is saved.
3. Press Save all settings. This save writes the role rules; before the first save there are none.
4. Log in as the shop manager, or reload the page they have open, and test one cell.

The same switch decides three things for the role: which columns the Products Editor draws, which fields the Bulk Edit tab offers, and which taxonomies the Filters tab lists. The shop manager FAQ shows a typical prices-and-stock setup. Keep in mind that the switch is one rule for all non-administrator roles: a custom role gets exactly what the shop manager gets. Different rules per role or per user need the filter below.

Grant full access or write per-role rules in code

Both filters go into the child theme's functions.php or a code snippets plugin. They are listed with the other hidden options on More settings (implicit).

Treat a role as administrator: woobe_permit_special_roles

// Child theme functions.php or a code snippets plugin.
// BEAR: shop managers get every field, like administrators.
add_filter( 'woobe_permit_special_roles', function ( $roles ) {
    $roles[] = 'shop_manager';
    return $roles;
} );

Use the role slug, not its display name; a custom role created with a role editor plugin has its own slug. A role in this list skips all field rules and is an administrator inside BEAR in every other way too: it sees the visible for the shop manager switches, the Meta Fields tab and the shop-wide options of the Settings tab, and it sees and can roll back the History of every user. Give it only to people you would give the administrator account.

Decide per field and per role: woobe_user_can_edit

BEAR asks this filter on every save by a role that is not in the special list. It receives the value from the Settings tab (1 allowed, 0 not), the field key and the whole visibility map, and must return 1 to accept the save or 0 to refuse it. An older example names the first argument $is_forbidden; it is the opposite, 1 means allowed.

// Child theme functions.php or a code snippets plugin.
// BEAR: the content team edits what the Settings tab allows, except prices.
add_filter( 'woobe_user_can_edit', function ( $can_edit, $field_key, $visibility ) {
    $user = wp_get_current_user();

    // 'catalog_editor' is the slug of your custom role
    if ( in_array( 'catalog_editor', (array) $user->roles, true )
        && in_array( $field_key, array( 'regular_price', 'sale_price' ), true ) ) {
        return 0;
    }

    return $can_edit;
}, 10, 3 );

The filter decides whether a save is accepted; it does not draw columns. A column that is unticked in Settings stays hidden from every non-administrator role, whatever the filter returns, so tick the columns that any of these roles need and narrow them per role in the filter. Forum answers often suggest a filter that simply returns 1. It does make forbidden disappear, but it lets every role that can open the editor change every visible field, which is usually not what you wanted to allow.

Restrict a role instead

The snippets in this section also go into the child theme's functions.php or a code snippets plugin.

• Read-only for everyone but administrators. Return 0 from woobe_user_can_edit for every field. Roles in the special list are never asked, so administrators keep editing.

  add_filter( 'woobe_user_can_edit', function ( $can_edit, $field_key, $visibility ) {
      return 0;
  }, 10, 3 );

• No publishing. Untick visible for the shop manager under the Status column. The role then cannot change the product status in the table or in Bulk Edit.
• Hide tabs. woobe_show_tabs receives the tab slug: settings, bulk, filters, export, history, meta or info (the Help tab). Check the role inside, otherwise the tabs disappear for administrators as well.

  add_filter( 'woobe_show_tabs', function ( $show, $slug ) {
      $user = wp_get_current_user();
  
      if ( in_array( 'shop_manager', (array) $user->roles, true )
          && in_array( $slug, array( 'settings', 'export', 'info' ), true ) ) {
          return false;
      }
  
      return $show;
  }, 99, 2 );

• No deleting. There is no option for it: deleting products in BEAR needs the same rights as editing them, and WordPress Trash receives what is deleted. To keep the delete buttons from working for anyone below administrator, refuse the two delete requests before BEAR handles them:

  // Only administrators may delete products from the bulk editor.
  foreach ( array( 'woobe_delete_products', 'woobe_bulk_delete_products' ) as $woobe_action ) {
      add_action( 'wp_ajax_' . $woobe_action, function () {
          if ( ! current_user_can( 'manage_options' ) ) {
              wp_die( '0', '', array( 'response' => 403 ) );
          }
      }, 0 );
  }

• Only own products. The Vendor roles option in the Settings tab takes role slugs; users with those roles see and edit only the products they authored.
• No bulk editor at all. Removing manage_woocommerce from a role takes away the editor, and the WooCommerce menu with it. To take away only BEAR from everyone below administrator, remove its menu entry and refuse the page itself, because a removed menu entry alone does not stop someone who opens the address directly:

  // BEAR only for administrators.
  add_action( 'admin_menu', function () {
      if ( ! current_user_can( 'manage_options' ) ) {
          remove_submenu_page( 'edit.php?post_type=product', 'woobe' );
      }
  }, 100 );
  
  add_action( 'admin_init', function () {
      if ( isset( $_GET['page'] ) && 'woobe' === $_GET['page'] && ! current_user_can( 'manage_options' ) ) {
          wp_die( 'Sorry, you are not allowed to access this page.', '', array( 'response' => 403 ) );
      }
  } );

Team setups: shared settings, profiles and History

Each account has its own BEAR settings (active columns, their order, options) and its own column and filter profiles. Two people can work at the same time without changing each other's screen, as the team FAQ describes. When everyone should see the same setup instead, one filter makes all accounts read and write a single configuration:

// Child theme functions.php or a code snippets plugin.
// BEAR: one settings set for all users instead of one per user.
add_filter( 'woobe_settings_key_options', function ( $key ) {
    return 'for_all';
} );

The shared configuration starts from the defaults, so set up the columns once after adding the filter. It holds the settings, not the role rules: the visible for the shop manager switches still apply.

Profiles are separate. The Synchronize managers profiles option (General settings, administrators only) makes all non-administrator accounts use one shared set of column and filter profiles; administrators always keep their own. The option is stored with the settings of the account that saves it, and every user reads their own settings, so managers pick it up when the accounts share one configuration through woobe_settings_key_options. Profiles saved before switching it on stay with the account that made them; create the shared ones again. A profile cannot be re-saved: create a new one and delete the old.

On a multisite network every site has its own BEAR settings, profiles and role rules; nothing is shared between sites. A super admin who has no role on a site counts as administrator there.

History follows the same line. Since version 2.2.4 every row records who made the change and whether it was done by hand or through the AI assistant. Administrators, and roles added with woobe_permit_special_roles, see and can roll back everyone's changes; other users see and roll back only their own. More in the History documentation.

If a shop manager still gets forbidden

1. Reload the editor page; a page left open for many hours sends an expired security token.
2. As administrator, open Settings, check the visible for the shop manager box under the field and press Save all settings, even if it already looks ticked.
3. Check the role in a role editor plugin: it needs manage_woocommerce, and edit_others_products to change products of other authors.
4. Look for your own snippets with woobe_user_can_edit that return 0, and confirm the role slug in woobe_permit_special_roles is spelled as the role really is.
5. If an administrator is affected, create a new administrator account and repeat the edit. When the new account works, the old one carries an extra role or edited capabilities.

If none of this explains it, describe the role, the field and what the cell shows on the BEAR support forum.