Hi fellow Wordpress users :)
I wanted to ask is it safe to allow non-admin users access to WordPress media uploader.
Can they inject a virus while uploading media? How is WP system fighting against it?
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It only takes a minute to sign up.Sign up to join this community
WP is reasonably secure for default use cases. In typical workflow it will call
wp_check_filetype_and_ext() to verify that file uploaded is of allowed type.
It can get considerably more questionable in regards to security if you customize it to work with non–default kinds of files and you might need to implement your own security checks.
Note that users with special
unfiltered_upload capability will be able to upload absolutely anything at all, so be very careful if you are assigning it to any roles.