This plugin generates forms which can have file attachments, allowing unauthenticated users to uploaded files to the web server which are placed in a known location.

The plugin uses .htaccess files to prevent direct access to uploaded files. This may not work in hardened environments where .htaccess parsing is disabled.

Combined with local file inclusion vulnerability, this plugin’s functionality would aid an attack, albeit with quite a narrow timing window.

Generally, the plugin also seems to have a lot of code to do what it does, but no other issues were found and the plugin is not vulnerable in its default/expected configuration.