access the plugins for each role in WordPress multisite

You cannot enable or disable plugins wholesale for specific user roles. A plugin’s ‘active-ness’ is not determined per-user. If you attempted to actually deactivate a plugin for a specific user role, then any time a user with that role logged in the plugin would be deactivated for every user that visited your site. A user has logged in that’s not allowed to manage WooCommerce? Now your store is down until a user that does have access logs in.

So ‘activating’ and ‘deactivating’ entire plugins for user roles is not the way to think about this. So what is?

The first thing to be aware of is how WordPress grants users permission to perform certain tasks. Under the hood, each user role has a list of “capabilities”. WordPress uses these capabilities to determine whether a user has permission to do certain things, and modifies the UI to reflect the user’s permissions and enforces security policies accordingly. You can see a list of the core WordPress roles and which capabilities they have here.

The second thing to be aware of is that plugins are typically not monoliths that grant or restrict access to their entire functionality with a binary yes or no. WooCommerce, for example, has functionality for adding products, viewing and managing orders, and configuring the plugin settings, among other things. As with WordPress, different users need different levels of access to these different parts of WooCommerce, so WooCommerce adds its own roles and capabilities that can be used to grant access to these various parts of the plugin. To grant users access to different sections of WooCommerce, you need to assign their role the correct capabilities. You can do this using code, or a plugin like User Role Editor.

However, that’s just WooCommerce. Every plugin is going to be different, and do its own thing. There is no standard that applies to every plugin that you can follow. Some plugins will do what WooCommerce does and add their own capabilities and let you assign them how you wish, but others might use WordPress’ core capabilities to grant or restrict access. A (frustratingly) large number of plugins are hard-coded to require the Administrator role to access their functionality, for example. In those cases there’s no workaround: You must be an Administrator to use the plugin.

So really, you’re going to need to go through every plugin one-by-one and check its documentation to find out how you can grant access to its functionality (or parts of it) to your users. The answer will be different every time. No one here can give you a definitive answer that will apply for every plugin.

That being said, there are plugins out there that claim to be able to manage this for you more simply, but be careful. Often these plugins merely hide the UI, and don’t actually securely remove access to the plugins or their functionality. A determined user might be able to bypass this type restriction.

Sometimes these plugins might be able to properly secure a plugin, but in those cases they very likely would have been built to specifically integrate with that plugin, and they just won’t have that integration for every plugin that’s available. If you use one of these plugins make sure you test them thoroughly to make sure the lower-level users truly don’t have access to things they’re not supposed to.

Another consideration with these plugins is that they won’t be able to selectively grant access to a plugin that is hard-coded to require Administrator access. Not without actually making the user an Administrator just merely hiding the other stuff they shouldn’t have access to. I can tell you from experience that many plugins are very bad at this, and simply won’t have an option to grant access to a user without making them an Administrator, no matter which plugin you use.