Ron is obviously being provocative deliberately. The interesting thing is the sort of response that he is provoking. Those responses (with the exception of that of mark k) highlight the major failing of the WordPress eco-system.

The inevitable response to a major error in any other walk of life would be to ask what we can learn from it. Of course humans make mistakes, so the question becomes what we can do in future to minimize the chance of a recurrence and/or catch them before they do any harm.

In the WordPress world, unfortunately, the dominant response is either "Well, what do you expect?" or "You should be grateful you got something for free!" Sometimes they even get combined into "Be grateful you got something for free, even though it's bound to be buggy!"

I had assumed that developers like to think of themselves as professionals. Yet we don't expect doctors or engineers to react like that. They are still humans, and they still make mistakes, but systems and procedures are set up to limit their occurrence and any harm they might do.

So where are the proposals for establishing systems to try to reduce the likelihood of a recurrence of what happened here? It was, after all, exactly what Ron has described: a spelling mistake. Despite what Slavi Marnov says, the plugin developer was not trying to target the "edit_user" capability at all. He meant "edit_users" and just misspelled it.

Surely the first problem that's apparent here is that it is crazy to have two such different capabilities present in WordPress when the only thing that differentiates them is one "s". That's just asking for trouble. If "edit_user" had been "edit_member", for example, then the spelling mistake would have been noticed because the plugin just wouldn't have worked. That's a simple fix that should be implemented asap.

But how many other such bear-traps are lurking? And what testing protocols should be developed and published? mark k is right that everyone needs to vet his/her own sites, but without some sort of checklist, that doesn't amount to much.

So please stop responding to Ron as though there's nothing that could have been/can be done, and let's see some practical suggestions on how to improve things in future.