diff -r 48c4eec2b7e6 -r 8c2e4d02f4ef wp/wp-admin/user-new.php
--- a/wp/wp-admin/user-new.php	Fri Sep 05 18:40:08 2025 +0200
+++ b/wp/wp-admin/user-new.php	Fri Sep 05 18:52:52 2025 +0200
@@ -34,6 +34,7 @@
 
 	$user_details = null;
 	$user_email   = wp_unslash( $_REQUEST['email'] );
+
 	if ( str_contains( $user_email, '@' ) ) {
 		$user_details = get_user_by( 'email', $user_email );
 	} else {
@@ -63,10 +64,14 @@
 	$redirect       = 'user-new.php';
 	$username       = $user_details->user_login;
 	$user_id        = $user_details->ID;
-	if ( null != $username && array_key_exists( $blog_id, get_blogs_of_user( $user_id ) ) ) {
+
+	if ( array_key_exists( $blog_id, get_blogs_of_user( $user_id ) ) ) {
 		$redirect = add_query_arg( array( 'update' => 'addexisting' ), 'user-new.php' );
 	} else {
 		if ( isset( $_POST['noconfirmation'] ) && current_user_can( 'manage_network_users' ) ) {
+
+			wp_ensure_editable_role( $_REQUEST['role'] );
+
 			$result = add_existing_user_to_blog(
 				array(
 					'user_id' => $user_id,
@@ -178,6 +183,7 @@
 			$redirect = add_query_arg( array( 'update' => 'add' ), 'user-new.php' );
 		}
 	}
+
 	wp_redirect( $redirect );
 	die();
 } elseif ( isset( $_REQUEST['action'] ) && 'createuser' === $_REQUEST['action'] ) {
@@ -202,6 +208,7 @@
 			} else {
 				$redirect = add_query_arg( 'update', 'add', 'user-new.php' );
 			}
+
 			wp_redirect( $redirect );
 			die();
 		}
@@ -209,15 +216,20 @@
 		// Adding a new user to this site.
 		$new_user_email = wp_unslash( $_REQUEST['email'] );
 		$user_details   = wpmu_validate_user_signup( $_REQUEST['user_login'], $new_user_email );
+
 		if ( is_wp_error( $user_details['errors'] ) && $user_details['errors']->has_errors() ) {
 			$add_user_errors = $user_details['errors'];
 		} else {
 			/** This filter is documented in wp-includes/user.php */
 			$new_user_login = apply_filters( 'pre_user_login', sanitize_user( wp_unslash( $_REQUEST['user_login'] ), true ) );
+
 			if ( isset( $_POST['noconfirmation'] ) && current_user_can( 'manage_network_users' ) ) {
 				add_filter( 'wpmu_signup_user_notification', '__return_false' );  // Disable confirmation email.
 				add_filter( 'wpmu_welcome_user_notification', '__return_false' ); // Disable welcome email.
 			}
+
+			wp_ensure_editable_role( $_REQUEST['role'] );
+
 			wpmu_signup_user(
 				$new_user_login,
 				$new_user_email,
@@ -226,6 +238,7 @@
 					'new_role'    => $_REQUEST['role'],
 				)
 			);
+
 			if ( isset( $_POST['noconfirmation'] ) && current_user_can( 'manage_network_users' ) ) {
 				$key      = $wpdb->get_var( $wpdb->prepare( "SELECT activation_key FROM {$wpdb->signups} WHERE user_login = %s AND user_email = %s", $new_user_login, $new_user_email ) );
 				$new_user = wpmu_activate_signup( $key );
@@ -245,6 +258,7 @@
 			} else {
 				$redirect = add_query_arg( array( 'update' => 'newuserconfirmation' ), 'user-new.php' );
 			}
+
 			wp_redirect( $redirect );
 			die();
 		}
@@ -252,7 +266,7 @@
 }
 
 // Used in the HTML title tag.
-$title       = __( 'Add New User' );
+$title       = __( 'Add User' );
 $parent_file = 'users.php';
 
 $do_both = false;
@@ -260,7 +274,7 @@
 	$do_both = true;
 }
 
-$help = '<p>' . __( 'To add a new user to your site, fill in the form on this screen and click the Add New User button at the bottom.' ) . '</p>';
+$help = '<p>' . __( 'To add a new user to your site, fill in the form on this screen and click the Add User button at the bottom.' ) . '</p>';
 
 if ( is_multisite() ) {
 	$help .= '<p>' . __( 'Because this is a multisite installation, you may add accounts that already exist on the Network by specifying a username or email, and defining a role. For more options, such as specifying a password, you have to be a Network Administrator and use the hover link under an existing user&#8217;s name to Edit the user profile under Network Admin > All Users.' ) . '</p>' .
@@ -271,7 +285,7 @@
 	'<p>' . __( 'By default, new users will receive an email letting them know they&#8217;ve been added as a user for your site. This email will also contain a password reset link. Uncheck the box if you do not want to send the new user a welcome email.' ) . '</p>';
 }
 
-$help .= '<p>' . __( 'Remember to click the Add New User button at the bottom of this screen when you are finished.' ) . '</p>';
+$help .= '<p>' . __( 'Remember to click the Add User button at the bottom of this screen when you are finished.' ) . '</p>';
 
 get_current_screen()->add_help_tab(
 	array(
@@ -374,7 +388,7 @@
 <h1 id="add-new-user">
 <?php
 if ( current_user_can( 'create_users' ) ) {
-	_e( 'Add New User' );
+	_e( 'Add User' );
 } elseif ( current_user_can( 'promote_users' ) ) {
 	_e( 'Add Existing User' );
 }
@@ -498,7 +512,7 @@
 
 if ( current_user_can( 'create_users' ) ) {
 	if ( $do_both ) {
-		echo '<h2 id="create-new-user">' . __( 'Add New User' ) . '</h2>';
+		echo '<h2 id="create-new-user">' . __( 'Add User' ) . '</h2>';
 	}
 	?>
 <p><?php _e( 'Create a brand new user and add them to this site.' ); ?></p>
@@ -650,7 +664,7 @@
 	do_action( 'user_new_form', 'add-new-user' );
 	?>
 
-	<?php submit_button( __( 'Add New User' ), 'primary', 'createuser', true, array( 'id' => 'createusersub' ) ); ?>
+	<?php submit_button( __( 'Add User' ), 'primary', 'createuser', true, array( 'id' => 'createusersub' ) ); ?>
 
 </form>
 <?php } // End if current_user_can( 'create_users' ). ?>