User Application Passwords Not Rendering for Non-Admins

[camber799]

Hi URE team, I’m seeing what looks like a URE/WordPress profile UI compatibility bug for non-admin roles.

Non-admin roles: Application Password create returns 201 but one-time password UI (the password itself) is not shown

Environment 1
– WordPress 6.9.1
– URE Pro 4.64.6
– PHP 8.3 (DDEV local)
– Control: Administrator user

– Environment 2
– WP 6.9.4
– URE Pro 4.64.6
– PHP 8.2.30

Repro steps
1. Log in as non-admin user
2. Open wp-admin/profile.php
3. In Application Passwords, enter a name and click Add Application Password.
4. Password not revealed
5. Check DevTools > Network.

What happens
– Request: ‘POST /wp-json/wp/v2/users/<id>/application-passwords?_locale=user’
– Response: ‘201 Created’
– Response JSON includes uuid + password (valid create)
– But the profile UI does not show the success notice / one-time password.

Control behavior
– Same test as Administrator works normally (notice appears and one-time password is shown).

Note too that if URE Pro plugin is disabled the non admin users can successfully access the password.

Why this seems role/UI related
Since REST create succeeds (201 + password), backend permission/create appears okay.
The issue appears to be in the role-specific profile UI/success render path for non-admin users.

Could you advise what URE setting/filter might cause this (profile restrictions, script/template availability, or capability filter behavior in wp-admin vs REST context)?

Thanks!

[Vladimir]

Hi,

Thanks for the detailed description.
Unfortunately, I can not repeat this issue. Is this happened with active URE Pro installed from the box? If not, share the settings you made in URE, which lead to the issue with application passwords. If you can share access to the site copy where I can repeat the issue, it would be helpful.

[Author]

Posts