Vladislav Marudenko

if ( ! function_exists( 'wp_handle_upload' ) ) {
        require_once( ABSPATH . 'wp-admin/includes/file.php' );
    }

    $uploadedfile = $_FILES['my_file_upload'];

    $upload_overrides = array( 'test_form' => false );

    $movefile = wp_handle_upload( $uploadedfile, $upload_overrides );

    if ($movefile && !isset( $movefile['error'] ) ) {
        echo "File is valid, and was successfully uploaded.\n";
        echo print_r( $movefile );
    } else {
        /**
         * Error generated by _wp_handle_upload()
         * @see _wp_handle_upload() in wp-admin/includes/file.php
         */
        echo $movefile['error'];
    }

<form enctype="multipart/form-data" action="" method="POST">
        <?php wp_nonce_field( 'my_file_upload', 'fileup_nonce' ); ?>
        <input name="my_file_upload" type="file" />
        <input type="hidden" name="upload" value="on">
        <input type="submit" value="Загрузить файл" />
    </form>

@header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
@header( 'Access-Control-Allow-Origin: https://domain.com' ); // Без слеша в конце. Не знаю почему, но это важно
@header( 'Access-Control-Allow-Credentials: true' );