File upload security

When to use this skill

Use this skill whenever code touches user-provided files or paths:

• Handling $_FILES from a form (front-end or admin).
• Saving uploads, avatars, imports, attachments, CSV/JSON imports.
• Building a filesystem path from user input (download handlers, include, readfile).
• Serving or deleting files based on a request parameter.

Arbitrary file upload is one of the highest-severity WordPress bugs — an uploaded .php in a web-served directory is remote code execution.

Core principles (and why they matter)