Turn off cloudflare and test.
It is a simple check box on the landing page next to the check box for I am having a ddos attack.
It is there just for this type of scenario to test cloudflare.
This will confirm or rule out cloudflare is the issue.
If attachments still don't work it is on your host or UBB side.
If attachments do work then try turning cloudflare back on and find what they call challenge setting turn it off and see if attachments work.
If they do then experiment with the different challenge levels.
