Hi@wrathyimp, Thanks for getting back to us.
Wordfence has three rules that check for unsanitized files containing malicious code that can be uploaded to and executed by the web server. The rules are “Malicious File Upload“, “Malicious File Upload (PHP)“, or “Malicious File Upload (Patterns)” and can be found in Wordfence > All Options > Firewall Options > Advanced Firewall Options > Rules after expanding the list.
There have been occasions when customers needed to disable one of these to prevent false-positives. There are layers to how uploaded files are checked, so having to turn one of these rules off to fix any issues should still ensure malicious files are caught at a different stage of the checking process. Disabling/enabling them one-by-one can reveal exactly which one(s) can be permanently turned off to prevent any upload issues reoccurring for your users.
I hope this answers your question.
Thanks,
Mark.