Common causes
- The extension is not on WordPress's default allow-list (SVG, JSON, fonts, EPS)
- The file's real content type does not match its extension (e.g. a CSV detected as text/plain or application/octet-stream)
- The user role lacks the unfiltered_upload capability
- On Multisite, the extension is missing from Network Settings > Upload file types
- A security plugin further restricts allowed upload types
How to fix it
- Confirm the file is what it claims. Open the file in a text editor or check it with the file command. A file renamed from another format will be rejected by WordPress's real-MIME check, which is correct behaviour.
- Add the MIME type with upload_mimes. In a small custom plugin or your child theme's functions.php, add only the extension you need to the upload_mimes filter, mapped to its correct MIME type.
- Handle mismatched MIME detection. If the type is allowed but still rejected, PHP fileinfo may report a different MIME. Map the extension to the MIME type that finfo actually reports, or use the wp_check_filetype_and_ext filter for that specific extension.
- Use a sanitizing plugin for SVG. SVG can contain JavaScript, so only allow it through a plugin that sanitizes SVG on upload, and restrict it to trusted roles.
- Update Multisite upload types. On Multisite go to Network Admin > Settings and add the extension to 'Upload file types'.
- Upload via SFTP when appropriate. For files that only need a URL (like a downloadable dataset), upload them over SFTP to a folder outside the media library instead of widening the allow-list.
custom plugin or child theme functions.php
add_filter( 'upload_mimes', function ( $mimes ) {
if ( current_user_can( 'manage_options' ) ) {
$mimes['json'] = 'application/json';
$mimes['woff2'] = 'font/woff2';
}
return $mimes;
} );How to stop it happening again
- Allow only the specific extensions you need, never a blanket ALLOW_UNFILTERED_UPLOADS
- Restrict risky types like SVG to administrators
- Keep uploads scanned, since media folders are a common malware drop point