wp-file-upload-security
Installation
SKILL.md
WordPress File Upload Security
Treat an upload as untrusted bytes plus attacker-controlled metadata. Use the core upload pipeline, then apply a narrower product policy; extension/MIME matching alone is not malware scanning or content safety.
Choose the flow
| Need | API |
|---|---|
| Create a normal Media Library attachment | media_handle_upload() |
| Store a local upload without an attachment post | wp_handle_upload() |
| Sideload a remote file | download_url() then media_handle_sideload() |
| Let a REST client create media | Core /wp/v2/media when its contract fits |
| Store a genuinely private document | Protected storage + authorized download controller, not a public uploads URL |
Do not manually combine move_uploaded_file(), a client MIME, and the original
name when core already provides unique naming, upload checks, and hooks.