diff --git src/wp-includes/rest-api/class-wp-rest-server.php src/wp-includes/rest-api/class-wp-rest-server.php
index 2ec8ccde23..d1f27570fa 100644
--- src/wp-includes/rest-api/class-wp-rest-server.php
+++ src/wp-includes/rest-api/class-wp-rest-server.php
@@ -240,7 +240,28 @@ class WP_REST_Server {
 		 */
 		$this->send_header( 'X-Content-Type-Options', 'nosniff' );
 		$this->send_header( 'Access-Control-Expose-Headers', 'X-WP-Total, X-WP-TotalPages' );
-		$this->send_header( 'Access-Control-Allow-Headers', 'Authorization, Content-Type' );
+
+		$allowed_headers = [
+			'Authorization',
+			'Content-Disposition',
+			'Content-MD5',
+			'Content-Type',
+		];
+
+		/**
+		 * Filter allowed headers for Cross-Origin requests.
+		 *
+		 * The allowed headers are passed to the browser to specify which
+		 * headers can be passed to the REST API. By default, we allow the
+		 * Content-* headers needed to upload files to the media endpoints.
+		 *
+		 * @since 4.9.0
+		 *
+		 * @param array $allowed_headers List of allowed headers to be passed in Access-Control-Allow-Headers
+		 */
+		$allowed_headers = apply_filters( 'rest_allowed_cors_headers', $allowed_headers );
+
+		$this->send_header( 'Access-Control-Allow-Headers', implode( ', ', $allowed_headers ) );
 
 		/**
 		 * Send nocache headers on authenticated requests.