Ticket #40193: 40193.diff

src/wp-admin/includes/ajax-actions.php

@@ -3219 +3219 @@
         $attachment_id = absint( $_POST['id'] );
 
         check_ajax_referer( 'image_editor-' . $attachment_id, 'nonce' );
-        if ( ! current_user_can( 'customize' ) ) {
+        if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
                 wp_send_json_error();
         }