For read-only mysql access -

grant select, show view on `<wordpress_schema_here>.* to `<your_user>`@'%';

Or for full access to that specific wordpress schema only:

GRANT Create Temporary Tables, Trigger, References, Insert, Update, Create Routine, Alter, Create View, Event, Lock Tables, Drop, Execute, Alter Routine, Create, Index, Delete, Select, Show View ON `<wordpress_schema_here>`.* TO `<your_user>`@`%`;

In general, I am not sure I would recommend FTP access as it requires a separate service to be installed (vsftpd, for example) and is not encrypted. Instead, I would recommend creating a local account on the Linux server that the wordpress admin can use sftp for to upload his files (such as via WinSCP). SFTP should use the already installed SSH, and also provides some kind of data encryption. You would have to ensure that the user has the proper privileges to upload to the directory that the wordpress install is at however, which may be at /var/www/html but it could be on a different directory according to your setup.

Hello SC,
Thanks for your response. I have installed vsftpd and configured server as per this guide- www.digitalocean.com/community/tutorials/how-to-configure-vsftpd-to-use-ssl-tls-on-an-ubuntu-vps

But I get this error- Connection attempt failed with ECONNREFUSED - Connection refused by server.
I am not sure where I am doing wrong. Below is my vsftpd.conf file(I have removed all settings which came as default after installation)

local_enable=YES
write_enable=YES
chroot_local_user=YES
chroot_list_enable=NO
allow_writeable_chroot=YES
anonymous_enable=NO
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH

Any advise on this will be helpful.

One thing I have noticed after I run

sudo service vsftpd restart

I get following-

stop: Unknown instance:
vsftpd stop/waiting

Not sure if that is correct.

I was able to login via ftp, had to change this in the default config -

pam_service_name=ftp