WCFM Vendor Staff stores staff accounts as users with the wcfm_vendor_staff role, linked to a primary vendor via wp_usermeta. Each staff member has a capabilities set (manage products, manage orders, view reports, etc.) configured by the vendor. The default WCFM admin lists staff per vendor through the front-end manager, but a marketplace-wide audit requires checking each vendor's staff in turn.

SleekView reads vendor staff across the marketplace and joins them with their primary vendor. A row shows staff name, vendor, role label, capabilities count, last login, and activation status. Filter for staff with admin-equivalent capabilities, scope to staff inactive for 30+ days, or surface staff at vendors flagged for review during a security audit.

Inline edits route through WCFM's staff API where supported, so capability changes update the user's effective permissions and the vendor's audit log records the change. Bulk operations (deactivate staff at suspended vendors, revoke a specific capability across the marketplace) run in seconds.

Vendor staff is one of those features that scales without anyone noticing until a security review happens. Each vendor adds a few staff members with reasonable-looking capabilities. The marketplace grows from 50 vendors to 500 and now there are 1,500 staff accounts with various capability sets across the marketplace, and the operator has never had a single screen to look at them on.

The data is correct: staff are real users with a clear primary-vendor relationship and a structured capability set stored in usermeta. The audit interface, however, is per-vendor and front-end driven, which means a marketplace-wide review requires going vendor by vendor or running custom SQL. SleekView gives security ops a real audit view across the marketplace from the same data.

Capability-based filters, inactivity-based filters, vendor-status-based filters, all writing through WCFM's APIs so the audit log stays correct. The quarterly review that took a day now takes an hour and finds the same issues, and crucially it runs often enough to catch new ones before they become incidents.