Fix WordPress Form & Security Issues

Our “Request a Quote” form on timberframeireland.ie suddenly stopped allowing file uploads about two weeks ago. The email notification still fires, so the blockage is clearly in the upload step. Visitors usually attach PDFs, JPEGs or even the odd DOCX, and we handle those through a dedicated upload plugin that has worked flawlessly for three years—right up until I updated a few other plugins recently. At the same time, Wordfence has begun flagging several security warnings, including an unfamiliar file sitting inside a core WordPress directory. Because the site runs on the Avada theme I’d like the investigation to stay within that ecosystem and keep every existing feature intact. What I need from you: • Diagnose and repair the upload failure without simply rebuilding the form or turning security measures off. • Identify the exact change—most likely a recent plugin update—that triggered the problem. • Review every current Wordfence alert, remove or quarantine anything malicious, and confirm no back doors remain. • Harden the site once the fixes are in place so the issue doesn’t re-appear with the next update. • Fully test the form with PDF, JPEG and DOCX uploads and confirm the client-side experience is smooth. Please take this on only if you’re comfortable working with WordPress, Avada, Wordfence and upload plugins at a surgical, not blanket-reset, level. I’m keen to see a concise summary of what you changed once the job is done so we can track it in our documentation.