Trac ticket: https://core.trac.wordpress.org/ticket/46544

Problem

Uploading an audio file whose real MIME type doesn't share the same major type as its extension is rejected with "Sorry, you are not allowed to upload this file type." The common real-world case is audio stored in an MP4/ISO-BMFF container — .m4a/.m4b, and some .mp3 files produced by mobile recorders — which fileinfo detects as video/mp4, while the extension maps to audio/mpeg.

In wp_check_filetype_and_ext(), the audio/* / video/* branch forgives sub-type mismatches but still requires the major type to match, so audio/mpeg (from the extension) vs video/mp4 (from finfo) fails and the file is rejected.

Change

Add a small, curated allow-list for known audio-in-MP4-container confusions inside that branch, mirroring the existing special-casing for text/csv and text/rtf. All three affected extensions (m4a, m4b, mp3) map to audio/mpeg, so the case collapses to a single entry:

$cross_container_types = array(
    'audio/mpeg' => array( 'video/mp4' ),
);

The check stays strict for every other combination. The application/octet-stream variant from the original report already passes today via the $nonspecific_types branch, so this targets only the remaining video/mp4 case.

Security: the worst case is a genuine MP4 video uploaded as .m4a being treated as audio/mpeg — both are allowed media types served as downloads, so no new upload vector is opened.

Testing instructions

1. Attempt to upload an audio file that fileinfo reports as video/mp4 (e.g. an .m4a from a phone recorder, or any MP4 container renamed to .m4a) via Media → Add New.
2. Before this change: the upload fails with "Sorry, you are not allowed to upload this file type."
3. After this change: the file uploads and appears in the Media Library as audio (audio/mpeg).

Automated coverage: a new case in the data_wp_check_filetype_and_ext provider uploads a fixture detected as video/mp4 and asserts it resolves to ext = m4a, type = audio/mpeg. The full Tests_Functions suite passes on single and multisite.

Use of AI Tools

• AI assistance: Yes
• Tool(s): Claude Code
• Model(s): Claude Opus 4.8
• Used for: investigating the root cause, drafting the fix and unit test, and verifying via automated tests and a live Media Library upload.