In reply to Ron.

I did read it, you should read it more carefully. If you did, you'd notice that the original edit_user check is still there. This is because the edit_user check is the more specific check to make. If he simply forgot an s like you claim, why didn't he just add an s?

KTS915, the reason you won't see edit_user in the screenshot is because the two are entirely disconnected. The usage of edit_user(s) in the security fix is being used as a permissions check to make sure the current user can edit the user before assigning them their new capabilities.

The reason you don't see edit_user in the screenshot as a capability is because it is what we refer to as a meta-capability. These aren't assigned directly to users, but are evaluated in a certain context like whether a given user can edit_user a certain user ID, or delete_post a certain post ID.

If you want to see for yourself, you can take a look at the map_meta_cap function in the code reference. As you can see, capabilities are very complicated in WordPress. What is important is that the developer released a security fix.