How to Block WordPress Users from Creating Higher-Level Users
By default, WordPress only allows Administrators to create users.
However, if you give them those permissions, they can create and edit users in any role. So you could have Editors creating and editing Administrator accounts. That could be a security problem.
Fortunately, PublishPress Permissions Pro has a feature called “Limit User Edit by Level”. If enabled, this prevents anyone from editing a user with a higher level or assigning a role higher than their own.
WordPress user levels explained
What does it mean when we say some WordPress users are at a higher level?
WordPress arrives with 5 key roles that you'll see on a new site. These roles are in a hierarchy from least important to most important:
How to limit user editing by level
Let me take you though an example of how this works with PublishPress Permissions Pro.
To start, I created a user with the “Editor” role.
Next, I used the PublishPress Capabilities plugin to make sure that my Editors had these permissions:
This allows them to access the “Users” link in the WordPress admin and also create new user accounts.
Thanks to PublishPress Permissions Pro, this image shows what they will see. This new user can access Editor and Author accounts, but not the Administrator account.
And if this user does click the “Add New” button and create a new user, they will not be able to choose the Administrator role.