Widen the upload blocklist to the executable spellings it forgot

[AllTerrainDeveloper]

Why

Prompted by the Forminator arbitrary file upload write-up (CVE-2026-15748, CVSS 9.8, ~600k sites). I audited our upload path against its two root causes.

We share neither root cause — this PR is defense-in-depth, not a fix for an active hole.

Forminator root cause	Us
Public handler trusted upload-field config from the request (forged via a Select field value)	alltfo_handle_uploads() reads filetypes/maxsize/maxfiles only from alltfo_get_form_schema($form_id) — the stored form. The request supplies bytes, never configuration.
Dangerous-extension blocklist did exact-key matching against pipe-joined MIME keys (php|php3|…)	Our check matches one real pathinfo extension against a flat set — no alternation to hide inside — then wp_check_filetype_and_ext() sniffs bytes, wp_handle_upload() runs with a mimes map scoped to the field, files land under a hashed name in a Require all denied directory as private attachments.

Also confirmed: no standalone/nopriv upload endpoint (Forminator's handle_file_upload was directly reachable); ours only runs inside the authenticated-or-not submission pipeline, after nonce/spam gating.

What changed

The blocklist claimed to cover "anything the web server might execute" but omitted several real spellings. Added: pht, phtm, php1, php2, php6, phpt, hphp, and the SSI trio shtml/shtm/stm. These were already caught by the byte check + deny-all directory in practice, but the unconditional first gate shouldn't rely on the layers behind it to cover a missing spelling.

Tests

New tests/phpunit/tests/uploads.php (4 tests, 37 assertions):

• every executable extension refused even when the field's own allow-list names it (blocklist overrides allow-list, and isn't filterable)
• double extension evil.php.jpg caught by the byte check
• the Forminator lesson in one assertion: accepted types come from the schema; a forged filetypes in the request changes nothing
• a legitimate .txt is accepted and stored private

744 PHPUnit ✓ · PHPCS 0 errors

🤖 Generated with Claude Code

https://claude.ai/code/session_01DVAaHFURDGeBzeuWHZ2dcP