Hot answers tagged security
You can use wpdb insert function. It's better in every way. It can care about data's escapeing itself and it's shorter. You can use your own query anyway but I would recommended this article for reading https://codex.wordpress.org/Data_Validation#Database
Whether or not you lock down a staging site really depends on how much you mind the public accidentally seeing a site that's a "work in progress". I'd usually consider it more of a branding decision than a security decision. (This of course wouldn't apply if you're in the middle of developing a secure application that might be buggy, but Wordpress theming - ...
If I understood correctly the situation described in the question and its comments, the user has capabilities to upload files and to edit your post type, so you shouldn't be fitering capabilities, the user already has the correct capabilities. The problem is that wp_editor() use the global $post by default, and in your context the global $post is for the ...
If you want to rename the wp-admin with the aim of adding additional layer of security to your WordPress installation, you can also try the Roots / Bedrock WordPress Boilerplate. It can help isolate the web root to limit access to non-web files. It can also help in organizing/securing the whole WordPress core by putting it in its own subdirectory like ...
Only top voted, non community-wiki answers of a minimum length are eligible