diff --git a/wp-admin/includes/plugin.php b/wp-admin/includes/plugin.php
index 88a95dda84d4..b4091325c8b1 100644
--- a/wp-admin/includes/plugin.php
+++ b/wp-admin/includes/plugin.php
@@ -592,7 +592,7 @@ function add_menu_page( $page_title, $menu_title, $access_level, $file, $functio
 	$admin_page_hooks[$file] = sanitize_title( $menu_title );
 
 	$hookname = get_plugin_page_hookname( $file, '' );
-	if (!empty ( $function ) && !empty ( $hookname ))
+	if (!empty ( $function ) && !empty ( $hookname ) && current_user_can( $access_level ) )
 		add_action( $hookname, $function );
 
 	if ( empty($icon_url) )
diff --git a/wp-admin/menu.php b/wp-admin/menu.php
index 6116f5aa81a3..a380f9f778bb 100644
--- a/wp-admin/menu.php
+++ b/wp-admin/menu.php
@@ -198,11 +198,13 @@
 // Remove menus that have no accessible submenus and require privs that the user does not have.
 // Run re-parent loop again.
 foreach ( $menu as $id => $data ) {
+	if ( ! current_user_can($data[1]) )
+		$_wp_menu_nopriv[$data[2]] = true;
+
 	// If submenu is empty...
 	if ( empty($submenu[$data[2]]) ) {
 		// And user doesn't have privs, remove menu.
-		if ( ! current_user_can($data[1]) ) {
-			$_wp_menu_nopriv[$data[2]] = true;
+		if ( isset( $_wp_menu_nopriv[$data[2]] ) ) {
 			unset($menu[$id]);
 		}
 	}