I’ve identified a problem with QUFORM when using an external database connection. When a form includes an upload field and users submit PDFs or other documents, the files are saved with their original filenames and stored in public directories. This allows unauthorized access to the uploaded documents very easely, which is a significant concern, especially for sensitive files like bills, CVs, and invoices from clients.
The best options would be access to selected roles, file names renamed(uniqid(); at least), and upload the files to private directories
With Laravel it is how I would have done it, now with wordpress I do not know much about its code structure to be honest.
.
