Nginx – WordPress Upload only images rule

WordPress already denies trying to upload PHP file, then there is no security hole at this place. read this : https://codex.wordpress.org/Uploading_Files