MediaNest Upload Manager

MediaNest Upload Manager is a complete media staging and workflow platform for WordPress.

Features:

• Chunked uploads (Plupload) with pause/cancel
• Folder drag-and-drop upload
• Directory browser with search and filter
• File preview (images, PDF) and URL copy
• Delete, rename, and move files
• Single, bulk, and folder import to Media Library
• Import status tracking in tree view
• Settings page (file types, roles, duplicates, import destination)
• Activity / audit log
• REST API (/wp-json/mediupma/v1/)
• Action/filter hooks for developers
• Gutenberg block: MediaNest File Browser
• Frontend shortcode: [medianest_upload folder="client-name"]
• Webhook notifications (optional)

Shortcode

Display a frontend upload form for logged-in users:

[medianest_upload folder="optional/subfolder" roles="subscriber,contributor"]

Attributes:

• folder — Target subfolder inside the staging directory (optional).
• roles — Comma-separated WordPress roles allowed to upload (optional).

REST API

The REST API lets external tools and custom integrations work with the staging folder. Enable it in Media -> MediaNest Settings.

Namespace: mediupma/v1
Base URL: /wp-json/mediupma/v1/

Authentication

Requests must be made by a logged-in WordPress user. Send the REST nonce in the request header:

X-WP-Nonce: your_rest_nonce

You can also use Application Passwords. Each endpoint checks plugin capabilities (view, import, delete, or manage_options).

GET /files

List all files and folders in the staging directory.

Example request:

GET /wp-json/mediupma/v1/files

Example response:

{ "tree": [ { "type": "file", "name": "photo.jpg", "relative": "photo.jpg", "size": 158000, "url": "..." } ] }

Permission: User can view staging files.

POST /import

Import one or more staging files into the Media Library.

Example request:

POST /wp-json/mediupma/v1/import

Body (JSON):

{ "relatives": [ "invoices/2026/photo.jpg", "report.pdf" ] }

Example response:

{ "success": [...], "failed": [...], "skipped": [...] }

Permission: User can import files.

DELETE /files/{path}

Delete a file or empty folder from the staging directory.

Example request:

DELETE /wp-json/mediupma/v1/files/invoices/2026/photo.jpg

Example response:

{ "message": "Deleted successfully." }

Permission: User can delete staging files.

GET /activity

Retrieve the latest activity log entries (upload, import, delete).

Example request:

GET /wp-json/mediupma/v1/activity

Example response:

{ "entries": [ { "action": "upload", "relative": "photo.jpg", "user": "Admin", "time": 1700000000 } ] }

Permission: User can view staging files.

GET /settings

Read plugin settings (webhook URL is excluded for security).

Example request:

GET /wp-json/mediupma/v1/settings

Permission: manage_options (administrator).

Developer Hooks

Extend or customize plugin behavior using WordPress actions and filters.

Action Hooks

Run custom code when staging files are uploaded, imported, or deleted.

Upload

• mediupma_before_upload — Fires before a file upload completes.
  Parameters: $relative (string), $user_id (int)
• mediupma_after_upload — Fires after a file is saved to the staging folder.
  Parameters: $relative (string), $user_id (int)

Import

• mediupma_before_import — Fires before a file is imported into the Media Library.
  Parameters: $relative (string), $user_id (int)
• mediupma_after_import — Fires after a successful import.
  Parameters: $attachment_id (int), $relative (string), $user_id (int)

Delete

• mediupma_before_delete — Fires before a staging file or folder is deleted.
  Parameters: $relative (string), $user_id (int)
• mediupma_after_delete — Fires after a staging file or folder is deleted.
  Parameters: $relative (string), $user_id (int)

Filter Hooks

Modify plugin defaults and permissions.

• mediupma_allowed_extensions — Filter the list of allowed file extensions.
  Parameters: $extensions (string array)
• mediupma_import_attachment_args — Filter attachment data before import.
  Parameters: $args (array), $relative (string)
• mediupma_can_manage — Filter whether a user can perform an action.
  Parameters: $can (bool), $user_id (int), $action (string: upload, import, delete, view, manage)

Example

Run custom code after a file is imported:

add_action( 'mediupma_after_import', function( $attachment_id, $relative, $user_id ) { /* your code */ }, 10, 3 );

1. Upload the plugin folder to /wp-content/plugins/
2. Activate the plugin through the Plugins menu in WordPress
3. Go to Media -> MediaNest Upload Manager
4. Configure settings at Media -> MediaNest Settings

Does this plugin create files outside WordPress uploads?

No. All content stays inside your WordPress uploads directory.

Can I allow video files?

Yes. Go to Media -> MediaNest Settings and configure allowed extensions.

How do I add frontend upload for clients?

Use the shortcode: [medianest_upload folder="client-deliveries" roles="subscriber"]

2.0.0

• Added file management: delete, rename, and move files from the directory browser.
• Added bulk import, folder import, and import status tracking in the tree view.
• Added image/PDF preview, copy URL, search, and file-type filters.
• Added settings page for file types, roles, duplicate handling, import destination, and uninstall cleanup.
• Added activity log, REST API, developer hooks, optional webhooks, Gutenberg block, and frontend shortcode.
• Added folder upload and upload queue pause/cancel controls.
• Added video and audio file support (configurable in settings).
• Improved chunked upload performance with memory-efficient file append.
• Fixed Copy URL on HTTP and local development sites.
• Added activation hook, translations support, and role-based permissions.

1.1.1

• Updated branding and improved admin/readme wording for WordPress.org.
• Security: restrict uploads and imports to images (JPG, PNG, GIF, WebP) and PDF only.
• Security: server-side content validation (image MIME detection, PDF magic bytes).
• Security: harden upload subfolders with index.php and .htaccess (Apache).
• Security: validate assembled file size after chunked uploads.
• Initial release.