Ticket #49150: 49150.patch

class-wp-rest-users-controller.php

@@ -609 +609 @@
                         sort( $request_params );
                         // If only 'id' and 'roles' are specified (we are only trying to
                         // edit roles), then only the 'promote_user' cap is required.
-                        if ( $request_params === array( 'id', 'roles' ) ) {
+                        if ( array( 'id', 'roles' ) === $request_params ) {
                                 return true;
                         }
                 }