About this plugin
Disclaimer: This plugin is not affiliated with, endorsed by, or sponsored by Rocketgenius, Inc. Gravity Forms is a trademark of Rocketgenius, Inc. This plugin is an independent third-party extension.
Out of the box, only Administrators can use Gravity Forms. That is usually wrong for real sites: the person who writes the content is often the same person who should build the contact form and read the submissions, but handing them an admin account to do it is a bad trade.
This plugin gives the Editor role access to Gravity Forms, and lets you decide precisely how much.
On activation it grants a sensible starting set: Editors can build, preview and delete forms, and view, edit, export and annotate entries. It does not grant anything that changes site configuration, and it does not grant entry deletion. From there, a single settings screen under Forms → Settings → Role Permissions turns each individual capability on or off with a checkbox.
Add-on capabilities are detected automatically
Add-ons register their own capabilities, and those are usually the ones that trip people up: the Editor can reach the form editor but the add-on’s settings tab is invisible, with no obvious reason why.
This plugin reads the active add-ons directly from Gravity Forms and lists their capabilities in their own sections, using the add-on’s own labels. Nothing is hard-coded. New add-ons, and third-party ones, show up without an update to this plugin, and add-ons you do not have are never shown.
Capabilities that can escalate to administrator
Some capabilities can be turned into full administrator access by the person you grant them to. gravityforms_user_registration is the clear case: it allows editing User Registration feeds, and those feeds assign WordPress roles, so anyone who holds it can make themselves an administrator.
Two more are blocked for the same reason. gform_full_access passes every Gravity Forms check, User Registration included. gravityforms_api_settings lets a role create REST API keys that act as any user, administrators included.
This plugin does not offer those capabilities at all. The settings screen lists each one with an info line instead of a checkbox, explaining that it is disabled because of the privilege escalation risk. That way it is clear the capability was considered, not overlooked.
If the Editor role already holds one because other code granted it, the screen says so, so you can remove it there.
If you maintain your own list, the resonanz_user_role_permissions_gf_blocked_caps filter lets you add to it. The built-in entries cannot be removed through the filter.
Careful with your existing setup
The plugin records which capabilities it granted. When you uninstall it, only those are removed. Capabilities the Editor role already had: from custom code, a role editor, or another plugin, are left exactly as they were.
Deactivating changes nothing at all. Your configuration is still there when you switch it back on.
Developed and maintained by Resonanz Digital, a web agency in Vienna building WordPress sites and custom web applications.