Hello I have a question about that detail, because nothing is written on the documentation for that specific part.
So I discovered that the form can be sent by visitors, not logged in the website, that's good to know (it wasn't displayed into the doc).
But, is it safe?
I mean my user can send a file, and also can set a title, does the visitors form can be used to change the post-id of another post to erase it? Or to upload some malicious files too?
If you don't want to show the frontend form for the visitors, you can create a custom code to check the logged-in user and output the frontend form with the shortcode.
.
