diff --git a/src/wp-admin/users.php b/src/wp-admin/users.php
index 214c06d8d3..95d9f768bb 100644
--- a/src/wp-admin/users.php
+++ b/src/wp-admin/users.php
@@ -321,10 +321,6 @@ case 'doremove':
$update = 'remove';
foreach ( $userids as $id ) {
$id = (int) $id;
- if ( $id == $current_user->ID && !is_super_admin() ) {
- $update = 'err_admin_remove';
- continue;
- }
if ( !current_user_can('remove_user', $id) ) {
$update = 'err_admin_remove';
continue;
@@ -377,10 +373,7 @@ case 'remove':
foreach ( $userids as $id ) {
$id = (int) $id;
$user = get_userdata( $id );
- if ( $id == $current_user->ID && !is_super_admin() ) {
- /* translators: 1: user id, 2: user login */
- echo "
" . sprintf(__('ID #%1$s: %2$s The current user will not be removed.'), $id, $user->user_login) . "\n";
- } elseif ( !current_user_can('remove_user', $id) ) {
+ if ( ! current_user_can( 'remove_user', $id ) ) {
/* translators: 1: user id, 2: user login */
echo "" . sprintf(__('ID #%1$s: %2$s Sorry, you are not allowed to remove this user.'), $id, $user->user_login) . "\n";
} else {
diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php
index 308c7063c8..78cde1c2ee 100644
--- a/src/wp-includes/capabilities.php
+++ b/src/wp-includes/capabilities.php
@@ -32,7 +32,12 @@ function map_meta_cap( $cap, $user_id ) {
switch ( $cap ) {
case 'remove_user':
- $caps[] = 'remove_users';
+ // In multisite the user must be a super admin to remove themselves.
+ if ( isset( $args[0] ) && $user_id == $args[0] && ! is_super_admin( $user_id ) ) {
+ $caps[] = 'do_not_allow';
+ } else {
+ $caps[] = 'remove_users';
+ }
break;
case 'promote_user':
case 'add_users':
diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php
index da1c313b88..d818ded9bf 100644
--- a/tests/phpunit/tests/user/capabilities.php
+++ b/tests/phpunit/tests/user/capabilities.php
@@ -1757,4 +1757,21 @@ class Tests_User_Capabilities extends WP_UnitTestCase {
wp_set_current_user( self::$users['editor']->ID );
$this->assertFalse( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) );
}
+
+ /**
+ * @ticket 39063
+ */
+ public function test_only_super_admins_can_remove_themselves_on_multisite() {
+ if ( ! is_multisite() ) {
+ $this->markTestSkipped( 'Test only runs in multisite.' );
+ }
+
+ $this->assertTrue( user_can( self::$super_admin->ID, 'remove_user', self::$super_admin->ID ) );
+
+ $this->assertFalse( user_can( self::$users['administrator']->ID, 'remove_user', self::$users['administrator']->ID ) );
+ $this->assertFalse( user_can( self::$users['editor']->ID, 'remove_user', self::$users['editor']->ID ) );
+ $this->assertFalse( user_can( self::$users['author']->ID, 'remove_user', self::$users['author']->ID ) );
+ $this->assertFalse( user_can( self::$users['contributor']->ID, 'remove_user', self::$users['contributor']->ID ) );
+ $this->assertFalse( user_can( self::$users['subscriber']->ID, 'remove_user', self::$users['subscriber']->ID ) );
+ }
}