Yes, if you assign ‘promote_users’ to another user, that user could promote non-site admins to site admin.
https://codex.wordpress.org/Roles_and_Capabilities#promote_users
Related Posts:
- What action should I hook into when adding roles and capabilities?
- What’s the difference between Role and Meta capabilities; When to use map_meta_cap() filter
- Disable posts, only allow to edit existing pages, not create new ones (create_posts)
- How to get all capabilities of an existing user role
- Add Media Upload Capabilities Needed for Custom Role for non-Posts
- How can I prevent a writer from being able to edit an article that has been scheduled?
- Check whether user can delete a given post
- Allow unfiltered HTML in titles for low level users?
- Allow users to set a post author
- Unify the roles and caps?
- Filter list of rules based on a capability
- Using author_can() on custom post types in WordPress
- How to show a admin bar menu item only to users with certain capabilities?
- Theme option editing capability problems
- Assign multiple roles , overlapping capabilities
- WordPress remove capability post ,media completely for custom role
- Add capability to a role , so user is only able to view his own posts
- Is there a way of retrieving the core WP capabilities?
- Best Roles and Capability on a site with review features using a front end custom post
- Manage Roles and Capabilities on Multi-site
- How to create a clone role in wordpress
- Select subscriber as author of post in admin panel?
- How do I make a draft post accessible to everyone?
- User-edit role setting distinct from wp_capabilities? [closed]
- Allow roles below admin to add subscribers only
- Disallowing Users of a Custom Role from Deleting or Adding Administrators?
- Add Custom User Capabilities Before or After the Custom User Role has Been Added?
- How can I grant capabilities directly to users (not roles) in wp-admin?
- How to update user role without logout
- What exactly is WordPress?
- WordPress Capabilities: edit_user vs edit_users
- Allow authors to edit only certain users
- Do not allow users to create new posts and pages
- Roles & capabilities GUI that does not create separate table
- Role that can edit only widgets, not other theme options
- How to programmatically add a user to a role?
- how to add custom user capabilities using add_user_meta or something else?
- How to restrict specific post types from being read or added by specific user roles (eg. author)?
- Allow users to publish child pages of the pages they have access to edit
- How do I code access to the built-in UI of a CPT when it’s placed as submenu of another CPT that is protected by role?
- How to get all users with Author role capabilities?
- How to allow “Add New” capability of CPT when links to its UI are placed as a submenu?
- How to check if a role has a specific capability
- Locking Down WordPress Application Password Permissions / Capabilities
- Custom Role can’t trash Custom Post Type
- Multiple Authors on Single Post
- Why do comment moderators need to have all create/edit/delete toboth posts and pages?
- How can I restore admin capabilities?
- current_user_can Not Always Working Properly
- What determines whether admin toolbar is shown to a logged-in user?
- Update User Role
- Prevent Editors from Editing/Deleting Admin Accounts
- Are User Levels Still Currently Used?
- Restricted user capabilities cannot add image
- Pending status by default for a specific role
- Is there a capability for managing plugin options?
- How do you set up a WordPress blog with multiple authors to allow something like StackExchange’s “community wiki” feature?
- How do I restrict user access to plugins?
- Allow Contributor to edit published post and filter by page id
- Applying roles to an admin sub-menu (eg Appearance -> Menus)
- Remove Capabilities from WP admin for specific user role
- Logout users upon login, based on caps/role?
- Show metabox for a special role
- Restrict Access to Posts based on Custom User and Post Meta Data
- upload_files cap to not loggen in users – add_cap to not logged in users
- Role capability issue
- Disable user from updating certain posts
- Custom capabilities to add, edit, remove users of a particular role only?
- Restricting Pages based on Hierarchy and User Role
- Allow user to only access custom post type
- add_role user capability not working
- Restrict Capability of Administrator to Create, Edit and Delete Pages in Multisite
- Is it wise not to use only meta capabilities for certain basic post types?
- How can I promote a user to a network administrator?
- How to add custom JavaScript in functions?
- What capabilities are assigned to unauthenticated users?
- Capabilities Not Changing
- Menu page with minimum capability as ‘Subscriber’ doesn’t allow ‘Admin’ to access it?
- Role capabilities issue
- Want to know parameters that can be passed to user_can() for access control by user capabilities
- The Capability to choose post/page template
- Create sub-administrator role that can do everything except use or see the code editor
- Assigning multiple or additional capabilities to specific users or how to create additional roles like bbpress roles?
- How To Create A File Archive in WordPress?
- User role editor – Add download files capability
- How to fix the Post Preview Button (CPT & map_meta_cap)
- Restrict Custom Post Type per role in Dashboard
- Restrict access to custom post type based on its taxonomy terms
- Allow contributor user role to perform copy operation PHP
- Remove dashboard links from wordpress
- Enable plugins for a specific user role
- How can I create multiple different admin roles with their own capabilities
- Groups roles & capabilities
- How can I remove “Add new” button on custom post type
- Why does user_can return false for a capability during plugin deactivation?
- Capabilities and mapping required for a role to be able to edit other’s posts of a custom type, BUT only be able to edit their own blog posts
- Disable `create_post` for built-in post type
- Weird capabilities / roles behavior
- Subscriber role – blank page
- edit slider plugin capability for custom_role