Media's "Allow SVG uploads" toggle — previously * existed in the UI with no backend behind it, so every SVG upload was * rejected by WordPress's default checks regardless of the setting. * * Two separate WP checks both have to pass, not just one: * 1. upload_mimes — the allowlist of extension => mime type pairs. * 2. wp_check_filetype_and_ext()'s real-mime sniff (finfo) — SVG is XML * text, so finfo reports something like text/plain, which doesn't * match image/svg+xml even after (1) allowlists it, and WordPress * nulls out ext/type as a security measure. Fixed here by restoring * them for .svg files specifically, which is the standard, documented * workaround for this exact WP behavior. * * Also does basic sanitization on upload (strips