From 666257a85abec5d897d824bdd7d1d1a96e8e74ae Mon Sep 17 00:00:00 2001
From: John Blackbourn <john@johnblackbourn.com>
Date: Tue, 11 Aug 2026 23:50:07 +0100
Subject: [PATCH 1/4] Prevent the default role from being set to a privileged
 role when user registration is open.

---
 src/wp-admin/options-general.php              |   7 +-
 src/wp-includes/default-filters.php           |   1 +
 src/wp-includes/functions.php                 |  24 +++
 .../tests/functions/filterDefaultRole.php     | 177 ++++++++++++++++++
 4 files changed, 208 insertions(+), 1 deletion(-)
 create mode 100644 tests/phpunit/tests/functions/filterDefaultRole.php

diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index 6a9a6d2f3812d..b9fd3e18e98c8 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -305,15 +305,20 @@ class="<?php echo esc_attr( $classes_for_button ); ?>"
 <th scope="row"><label for="default_role"><?php _e( 'New User Default Role' ); ?></label></th>
 <td>
 	<?php
+	/* This filter is documented in wp-includes/functions.php */
+	$roles_to_exclude = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+
 	/**
 	 * Filters the roles to be excluded from the default_role option.
 	 *
+	 * See also the {@see 'default_role_excluded_roles'} filter.
+	 *
 	 * @since 7.0.0
 	 *
 	 * @param string[] $roles_to_exclude Array of roles to exclude from the dropdown.
 	 *                                   Defaults to administrator and editor.
 	 */
-	$excluded_roles = (array) apply_filters( 'default_role_dropdown_excluded_roles', array( 'administrator', 'editor' ) );
+	$excluded_roles = (array) apply_filters( 'default_role_dropdown_excluded_roles', $roles_to_exclude );
 
 	$editable_roles = array_reverse( get_editable_roles() );
 
diff --git a/src/wp-includes/default-filters.php b/src/wp-includes/default-filters.php
index 12ca0045b98b4..b2c3fd92aa82d 100644
--- a/src/wp-includes/default-filters.php
+++ b/src/wp-includes/default-filters.php
@@ -302,6 +302,7 @@
 add_filter( 'option_blog_charset', '_canonical_charset' );
 add_filter( 'option_home', '_config_wp_home' );
 add_filter( 'option_siteurl', '_config_wp_siteurl' );
+add_filter( 'option_default_role', 'filter_default_role' );
 add_filter( 'tiny_mce_before_init', '_mce_set_direction' );
 add_filter( 'teeny_mce_before_init', '_mce_set_direction' );
 add_filter( 'pre_kses', 'wp_pre_kses_less_than' );
diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index f5002a45de1e8..1e4947a8c613a 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -9396,3 +9396,27 @@ function wp_verify_fast_hash(
 
 	return hash_equals( $hash, wp_fast_hash( $message ) );
 }
+
+function filter_default_role( $default_role ) {
+	$users_can_register = get_option( 'users_can_register' );
+
+	if ( ! $users_can_register ) {
+		return $default_role;
+	}
+
+	/**
+	 * Filters the roles that are excluded from being available as the default role for new user registrations.
+	 *
+	 * @since x.y.z
+	 *
+	 * @param string[] $roles Roles that are excluded from being available.
+	 */
+	$excluded = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+
+	// Don't allow a privileged default role if users can register.
+	if ( in_array( $default_role, $excluded, true ) ) {
+		$default_role = 'subscriber';
+	}
+
+	return $default_role;
+}
diff --git a/tests/phpunit/tests/functions/filterDefaultRole.php b/tests/phpunit/tests/functions/filterDefaultRole.php
new file mode 100644
index 0000000000000..5ec6b6e0693c8
--- /dev/null
+++ b/tests/phpunit/tests/functions/filterDefaultRole.php
@@ -0,0 +1,177 @@
+<?php
+
+/**
+ * Tests for the filtering of the `default_role` option.
+ *
+ * @group option
+ * @group user
+ *
+ * @covers ::filter_default_role
+ */
+class Tests_Functions_FilterDefaultRole extends WP_UnitTestCase {
+
+	/**
+	 * Opens or closes user registration.
+	 */
+	private function set_users_can_register( bool $can_register ) {
+		if ( is_multisite() ) {
+			update_site_option( 'registration', $can_register ? 'user' : 'none' );
+		} else {
+			update_option( 'users_can_register', $can_register ? 1 : 0 );
+		}
+	}
+
+	/**
+	 * Ensures privileged roles are left alone when user registration is closed.
+	 *
+	 * @dataProvider data_excluded_roles
+	 */
+	public function test_excluded_role_is_unchanged_when_registration_is_closed( string $role ) {
+		$this->set_users_can_register( false );
+
+		$this->assertSame(
+			$role,
+			filter_default_role( $role ),
+			'The default role was changed while user registration was closed.'
+		);
+	}
+
+	/**
+	 * Ensures privileged roles are replaced with the subscriber role when user registration is open.
+	 *
+	 * @dataProvider data_excluded_roles
+	 */
+	public function test_excluded_role_is_replaced_when_registration_is_open( string $role ) {
+		$this->set_users_can_register( true );
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( $role ),
+			'The privileged default role was not replaced with the subscriber role.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_excluded_roles() {
+		return array(
+			'administrator' => array( 'administrator' ),
+			'editor'        => array( 'editor' ),
+		);
+	}
+
+	/**
+	 * Ensures roles that are not excluded are left alone when user registration is open.
+	 *
+	 * @dataProvider data_allowed_roles
+	 */
+	public function test_allowed_role_is_unchanged_when_registration_is_open( string $role ) {
+		$this->set_users_can_register( true );
+
+		$this->assertSame(
+			$role,
+			filter_default_role( $role ),
+			'A role which is not excluded was changed.'
+		);
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public static function data_allowed_roles() {
+		return array(
+			'author'       => array( 'author' ),
+			'contributor'  => array( 'contributor' ),
+			'subscriber'   => array( 'subscriber' ),
+			'unknown role' => array( 'this-role-does-not-exist' ),
+			'empty string' => array( '' ),
+		);
+	}
+
+	/**
+	 * Ensures a role can be added to the list of excluded roles.
+	 */
+	public function test_excluded_roles_can_be_added_to() {
+		$this->set_users_can_register( true );
+
+		add_filter(
+			'default_role_excluded_roles',
+			static function ( $excluded ) {
+				$excluded[] = 'author';
+				return $excluded;
+			}
+		);
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( 'author' ),
+			'A role added to the excluded roles was not replaced with the subscriber role.'
+		);
+	}
+
+	/**
+	 * Ensures a role can be removed from the list of excluded roles.
+	 */
+	public function test_excluded_roles_can_be_removed() {
+		$this->set_users_can_register( true );
+
+		add_filter( 'default_role_excluded_roles', '__return_empty_array' );
+
+		$this->assertSame(
+			'administrator',
+			filter_default_role( 'administrator' ),
+			'A role removed from the excluded roles was replaced.'
+		);
+	}
+
+	/**
+	 * Ensures a new user is not assigned a privileged role when user registration is open.
+	 */
+	public function test_new_user_is_not_assigned_a_privileged_role() {
+		$this->set_users_can_register( true );
+		update_option( 'default_role', 'administrator' );
+
+		$user_id = wp_insert_user(
+			array(
+				'user_login' => 'test_default_role',
+				'user_pass'  => 'password',
+				'user_email' => 'test_default_role@example.org',
+			)
+		);
+
+		$this->assertNotWPError( $user_id, 'The user was not created.' );
+		$this->assertSame(
+			array( 'subscriber' ),
+			get_userdata( $user_id )->roles,
+			'The new user was assigned a privileged role.'
+		);
+	}
+
+	/**
+	 * Ensures a new user is assigned the stored role when user registration is closed.
+	 */
+	public function test_new_user_is_assigned_the_stored_role_when_registration_is_closed() {
+		$this->set_users_can_register( false );
+		update_option( 'default_role', 'editor' );
+
+		$user_id = wp_insert_user(
+			array(
+				'user_login' => 'test_default_role',
+				'user_pass'  => 'password',
+				'user_email' => 'test_default_role@example.org',
+			)
+		);
+
+		$this->assertNotWPError( $user_id, 'The user was not created.' );
+		$this->assertSame(
+			array( 'editor' ),
+			get_userdata( $user_id )->roles,
+			'The new user was not assigned the stored default role.'
+		);
+	}
+}

From e705bedf0e578aae963650e5375b8dbfe129feaf Mon Sep 17 00:00:00 2001
From: John Blackbourn <john@johnblackbourn.com>
Date: Sun, 16 Aug 2026 16:28:35 -0700
Subject: [PATCH 2/4] Docs.

---
 src/wp-admin/options-general.php |  2 +-
 src/wp-includes/functions.php    | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index b9fd3e18e98c8..b21055b867c66 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -305,7 +305,7 @@ class="<?php echo esc_attr( $classes_for_button ); ?>"
 <th scope="row"><label for="default_role"><?php _e( 'New User Default Role' ); ?></label></th>
 <td>
 	<?php
-	/* This filter is documented in wp-includes/functions.php */
+	/** This filter is documented in wp-includes/functions.php */
 	$roles_to_exclude = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
 
 	/**
diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 1e4947a8c613a..bb237f12568e3 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -9397,6 +9397,16 @@ function wp_verify_fast_hash(
 	return hash_equals( $hash, wp_fast_hash( $message ) );
 }
 
+/**
+ * Filters the default role for new user registrations.
+ *
+ * This ensures that privileged roles are not made available as the default role when user registration is enabled.
+ *
+ * @since 7.2.0
+ *
+ * @param string $default_role The default role for new user registrations.
+ * @return string The filtered default role for new user registrations.
+ */
 function filter_default_role( $default_role ) {
 	$users_can_register = get_option( 'users_can_register' );
 
@@ -9407,7 +9417,7 @@ function filter_default_role( $default_role ) {
 	/**
 	 * Filters the roles that are excluded from being available as the default role for new user registrations.
 	 *
-	 * @since x.y.z
+	 * @since 7.2.0
 	 *
 	 * @param string[] $roles Roles that are excluded from being available.
 	 */

From 1689fa81aa2899c4791d36a6c60048381c7380f3 Mon Sep 17 00:00:00 2001
From: John Blackbourn <john@johnblackbourn.com>
Date: Thu, 27 Aug 2026 20:47:20 +0200
Subject: [PATCH 3/4] Expand the multisite tests.

---
 .../tests/functions/filterDefaultRole.php     | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/tests/phpunit/tests/functions/filterDefaultRole.php b/tests/phpunit/tests/functions/filterDefaultRole.php
index 5ec6b6e0693c8..181cc52f35690 100644
--- a/tests/phpunit/tests/functions/filterDefaultRole.php
+++ b/tests/phpunit/tests/functions/filterDefaultRole.php
@@ -152,6 +152,42 @@ public function test_new_user_is_not_assigned_a_privileged_role() {
 		);
 	}
 
+	/**
+	 * Ensures the network registration setting governs the default role on Multisite, even when
+	 * the `users_can_register` option of the current site is closed.
+	 *
+	 * @ticket 46744
+	 * @group ms-required
+	 */
+	public function test_network_registration_governs_when_site_option_is_closed() {
+		update_site_option( 'registration', 'user' );
+		update_option( 'users_can_register', 0 );
+
+		$this->assertSame(
+			'subscriber',
+			filter_default_role( 'administrator' ),
+			'The privileged default role was not replaced while network registration was open.'
+		);
+	}
+
+	/**
+	 * Ensures the network registration setting governs the default role on Multisite, even when
+	 * the `users_can_register` option of the current site is open.
+	 *
+	 * @ticket 46744
+	 * @group ms-required
+	 */
+	public function test_network_registration_governs_when_site_option_is_open() {
+		update_site_option( 'registration', 'none' );
+		update_option( 'users_can_register', 1 );
+
+		$this->assertSame(
+			'administrator',
+			filter_default_role( 'administrator' ),
+			'The default role was changed while network registration was closed.'
+		);
+	}
+
 	/**
 	 * Ensures a new user is assigned the stored role when user registration is closed.
 	 */

From c6af56f55eae0e88d61ff60999e2d8e5cc5a764f Mon Sep 17 00:00:00 2001
From: John Blackbourn <john@johnblackbourn.com>
Date: Thu, 27 Aug 2026 20:47:29 +0200
Subject: [PATCH 4/4] Add a re-entry guard.

---
 src/wp-includes/functions.php | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index bb237f12568e3..9ca4fb994dd72 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -9408,25 +9408,31 @@ function wp_verify_fast_hash(
  * @return string The filtered default role for new user registrations.
  */
 function filter_default_role( $default_role ) {
-	$users_can_register = get_option( 'users_can_register' );
+	static $filtering = false;
 
-	if ( ! $users_can_register ) {
+	if ( $filtering ) {
 		return $default_role;
 	}
 
-	/**
-	 * Filters the roles that are excluded from being available as the default role for new user registrations.
-	 *
-	 * @since 7.2.0
-	 *
-	 * @param string[] $roles Roles that are excluded from being available.
-	 */
-	$excluded = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+	$filtering = true;
 
-	// Don't allow a privileged default role if users can register.
-	if ( in_array( $default_role, $excluded, true ) ) {
-		$default_role = 'subscriber';
+	if ( get_option( 'users_can_register' ) ) {
+		/**
+		 * Filters the roles that are excluded from being available as the default role for new user registrations.
+		 *
+		 * @since 7.2.0
+		 *
+		 * @param string[] $roles Roles that are excluded from being available.
+		 */
+		$excluded = apply_filters( 'default_role_excluded_roles', array( 'administrator', 'editor' ) );
+
+		// Don't allow a privileged default role if users can register.
+		if ( in_array( $default_role, $excluded, true ) ) {
+			$default_role = 'subscriber';
+		}
 	}
 
+	$filtering = false;
+
 	return $default_role;
 }