just res.code == 200 can easily lead to false positives. If there is anything in the response which could help to identify a real /wp-content/themes/OptimizePress/lib/admin/media-upload.php component, the check would be more confident.