WordPress Capability

A capability is a permission WordPress checks before allowing a protected action. Roles group capabilities, while object-specific checks can depend on the target content and user. A plugin should ask whether the current user can perform the relevant action. A nonce verifies request intent but does not replace the capability check that establishes authorization.