Weird. I am using the embedded form shortcode inside a post, and even as an administrator with full read rights I was unable to upload. However, disabling “high security” in the form settings solved the problem. Thanks!!