If the file isn’t an image, its mime type is checked against the allowed list.
As your example would generate a text mimetype, and it’s an allowed file extension, it passes through. There should be no concern unless your server is executing image files as PHP, in which case this issue is the least of your concerns.
If you consider it a bug though, you should open a Trac ticket, this isn’t the place for reporting WP bugs
Related Posts:
- Security around save_post hook
- Is there a way to send HTML formatted emails with WordPress’ wp_mail() function?
- Is there a hook that runs after a user logs in?
- Hook after image is uploaded and image sizes generated
- How to call a REST endpoint when a post is published?
- __NAMESPACE__ with register_activation_hook
- How to check if which hook triggered the call to a function?
- Hook for URL Request
- Hook/notify when any option or setting is added or updated
- Which hooks is this? add_action(‘wp’,
- admin_notices after register_uninstall / deactivate_hook
- Hooks are not executing
- add_action on inherit post status
- Best possible way to get all options
- Why does wp_enqueue_script ignore my ‘wp_head’ hook?
- action lifecycle
- Redirect users on specific post category or category page
- Returning ACF custom field from publish_post
- How to modify an add_action() inside a loop of core function
- What is the best filter where to use register_block_type?
- How get list all users who edited post?
- Stuck in redirect loop after using wp_login action
- Hooks for Links Box [duplicate]
- Check if do_action(‘custom_action’) is hooked into?
- Hook after wp_enqueue_scripts
- wp_login Action hook with conditional tag
- Can I remove WooCommerce main content hook?
- How to alter the query using pre_get_posts hook and is_post_type_archive
- How to update WordPress core or themes and still have my child theme hooks work
- Proper indentation of code generated inside hooks
- Add parameter (time) to oembed
- How to find a callback attached to a bbpress hook?
- How to extend custom (non-core) blocks?
- How can I count post views of REST API calls and update them in an ACF field?
- Event-Driven Pattern vs MVC?
- Using hooks with extra parameters
- How to catch and modify custom field values when a page is updated
- Genesis: How to add content after aside and before the content-sidebar wrap
- new_to_publish fires multiple times
- Implement Hooks Using Array
- What hook is used to display the admin_bar on the front end?
- Plugin init hook
- Best action hook for placing ical requests
- Is there a hook that fires when a row of wp_sitemeta table is updated?
- `rest_user_query` can’t access post author in post edit screen
- Post Meta Emtpy on Publish Using Transition
- How to check post type when using sanitize_title hook?
- How do I trigger a post update within a get_posts() foreach loop?
- Duplicate Cron Jobs Using wp_next_scheduled / wp_schedule_event
- Hook when editing user
- get_post_metadata causing some meta data to fail
- How to change the default mail when admin approuved an user?
- How to modify how the_content outputs a link to an internal page
- read more, even if excerpt not trimmed
- Conditional for autosave or auto draft?
- How do I prevent term from being created on create_term hook?
- How to distinguish on hook profile_update user registering, user resetting password or user updating profile?
- Hook to init or call explicitly within functions.php
- Hook function prints output twice
- Hook priority in admin with custom plugin
- Embeding style into the header via the function.php
- ‘save_post’ hook not working in WP 3.5
- Change the Default Plugin page filter to Active intead of All
- Remove Header and Footer if user is not logged on
- How to execute a hook asynchronously?
- Issues with if, else, and elseif statements
- How to add a HTML element in ADMIN edit post window?
- wp query add array by if condition
- WP Cron not executing after timespan
- Gravity Forms | Form Object is NULL [closed]
- Change status of page after an event (Looking for best practice advice)
- add_action hook for links.php page
- Add action save post when create and publish
- Hooks for Start/End of Batch Plugin Updates in wordpress
- How to load another post if condition is true
- Add a Call to Action Button to WordPress Post Thumbnail
- Struggling with plugin dev basics: add_action
- RTrouble passing arguments to action
- What hook can you use to get the full response?
- delete_user hook failed
- Which things should be called with `after_setup_theme`?
- Changing header logo href for the checkout page
- Prefixing widget_posts_args Hook
- Can’t get ID of post that relates to the comment
- Updating user meta data from external link, user not logged in
- adding wordpress yoast SEO canonical url from “transition_post_status” hook
- Remove lines from RSS Feed
- Security question – Display a General Custom Login Error Message
- Is there a hook that triggers when grant secondary user role in WordPress?
- How can I insert custom html code inside a div dynamically?
- How to trigger click events using hooks
- remove_action() hook not working
- How WordPress understands what do with the (all) key in the $wp_filter array? [duplicate]
- Function Hooked on Init Running Multiple Times
- WP-Automatic to run publish hooks
- Hide post completely and still reach it via cURL
- Problem in register activation hook and Copying folder
- Why does hook priority affects admin menu permission error?
- How do I change TinyMCE button “i” to create a i tag rather than em? [duplicate]
- add_action failed to display function by a plugin