Yes, if you assign ‘promote_users’ to another user, that user could promote non-site admins to site admin.
https://codex.wordpress.org/Roles_and_Capabilities#promote_users
Related Posts:
- What action should I hook into when adding roles and capabilities?
- What’s the difference between Role and Meta capabilities; When to use map_meta_cap() filter
- Disable posts, only allow to edit existing pages, not create new ones (create_posts)
- How to get all capabilities of an existing user role
- Add Media Upload Capabilities Needed for Custom Role for non-Posts
- How can I prevent a writer from being able to edit an article that has been scheduled?
- Check whether user can delete a given post
- Allow unfiltered HTML in titles for low level users?
- Allow users to set a post author
- Unify the roles and caps?
- Filter list of rules based on a capability
- Using author_can() on custom post types in WordPress
- How to show a admin bar menu item only to users with certain capabilities?
- Theme option editing capability problems
- Assign multiple roles , overlapping capabilities
- WordPress remove capability post ,media completely for custom role
- Add capability to a role , so user is only able to view his own posts
- Is there a way of retrieving the core WP capabilities?
- Best Roles and Capability on a site with review features using a front end custom post
- Manage Roles and Capabilities on Multi-site
- Getting a List of Currently Available Roles on a WordPress Site?
- Editor can create any new user except administrator
- Is there way to rename user role name without plugin?
- How to create a clone role in wordpress
- Possible to hide Custom Post Type UI/Menu from specific User Roles?
- How to add a Capability to a User Role?
- Select subscriber as author of post in admin panel?
- How can I get a list of users by their role?
- Remove Ability for Other Users to View Administrator in User List?
- How do I make a draft post accessible to everyone?
- Reset default roles and capabilities
- add_role() run only once?
- Custom post type role permissions won’t let me read
- what’s the meaning of the field wp_capabilities in table wp_usermeta
- What is valid timing of using current_user_can() and related functions?
- Allowing custom role access to custom post type in back end
- Allow Contributor to change the author of his own post?
- WordPress SEO by Yoast: Hide Meta Boxes in Posts for Non-admins
- Groups of capabilities: users with multiple roles?
- User-edit role setting distinct from wp_capabilities? [closed]
- What do unfiltered_html and unfiltered_upload actually filter?
- Allow Editors to edit pending posts but not draft ones
- Temporary capability for current_user_can()
- Allow user to “edit_others_posts” to save only, not publish
- Allow roles below admin to add subscribers only
- How to let contributors to create a new revision(draft) editing their published posts
- Disallowing Users of a Custom Role from Deleting or Adding Administrators?
- Add Custom User Capabilities Before or After the Custom User Role has Been Added?
- How to assign specific users the capability to edit specific pages / posts / custom post types
- How can I modify the Capability needed to access a plugin’s options?
- How can I grant capabilities directly to users (not roles) in wp-admin?
- How to enable a site administrator to edit users in a WordPress network/ multisite setup?
- Allow user to Edit Posts but not Add New?
- Defining capabilities for custom post type
- Temporarily give ‘manage_options’ capability
- Confusion with adding meta capabilities to a role after registering a Custom Post Type with corresponding ‘capability_type’ parameter
- Can I make user role that can only access a certian content type?
- How to update user role without logout
- How to check user role without using current_user_can()
- What exactly is WordPress?
- Apply custom role capabilities to administrator (without plugin)
- Hide specific admin users’ posts
- Possible to make custom role in multisite that can add sites?
- WordPress Capabilities: edit_user vs edit_users
- Allow authors to edit only certain users
- Do not allow users to create new posts and pages
- How to update role capabilities
- Menu capability in WordPress
- \WP_User Object | What’s the Difference Between {caps} and {allcaps}?
- Capability to edit own posts and not others
- Roles & capabilities GUI that does not create separate table
- Allowing Custom Capability to Manage Plugin Options
- Do custom user roles have any default capabilities?
- How to enable the theme editor cap for an editor role?
- Create user role restricted to specific CPT
- current_user_can( ‘edit_post’, $post_id ) does not work for contributer but for administrator
- Editor role cannot save custom theme options
- How to set individual capabilities on a taxonomy? Or how to re-register an existing taxonomy?
- Role that can edit only widgets, not other theme options
- How to assign capabilities to user NOT to User Role
- How to programmatically add a user to a role?
- Prevent user creating new users with specific roles
- Add user capability and check against it
- how to add custom user capabilities using add_user_meta or something else?
- How can I prevent users from creating new categories?
- Add Capabilities to Custom Post Type after it has been created [duplicate]
- Remove upload_files capability from a role but allow role to manage an avatar image
- How to Structure a New Role/Capability Scheme?
- Allow user to Publish, but not Edit or Delete
- How to not allow custom roles to edit published custom post types?
- Listing all capabilities in dropdown is returning boolean
- Email notification for editors only
- How-to Delay The Capability To Publish Posts?
- Shold I manually add ‘cap’ to admin role ?
- How to restrict specific post types from being read or added by specific user roles (eg. author)?
- add_cap only adding the first two in array
- Allow users to publish child pages of the pages they have access to edit
- How do I code access to the built-in UI of a CPT when it’s placed as submenu of another CPT that is protected by role?
- New Roles and Capabilities in WordPress
- Why is wp-login redirecting to the home page when I use this function?