This works great, but it also allows these user roles to read through other users private messages, change avatars, settings etc

If this applies to non-admin users such as contributors or subscribers, then this is a mighty big flaw. If that is happening due to the plugin then I’d expect the plugin author will want to know about it.…[Read more]