Changelogs

Follow the improvements and fixes in each product release.

Core Forms

Core Forms is a WordPress form plugin built for performance and simplicity. It creates contact forms, registration forms, and surveys with minimal overhead and clean code output. This…

Explore Product

Release History

Permalink

4.2.0

Stable release. Consolidates eleven betas (`v4.2.0-beta` through `v4.2.0-beta11`) into one shipping version.

WhatsApp, three ways

Three new actions cover the full range of WhatsApp delivery models — pick whichever fits your existing stack.

  • WhatsApp Cloud API action. Send template messages and free-form text (24-hour window) via Meta’s Graph API. Free tier covers 1,000 conversations per month. Credentials live globally under Settings → WhatsApp Cloud API with per-action override; a “Test connection” button reports the verified business name + quality rating.
  • Twilio WhatsApp action. For shops already on Twilio — reuses your Account SID / Auth Token, posts to the `whatsapp:` channel, supports approved Content Template SIDs.
  • Click-to-WhatsApp redirect. Generates a `wa.me` deep link with the submission pre-filled into the chat draft, used as the post-submit redirect.

Both Cloud API and Twilio sends log through Email Logs. The `cf_form_redirect_url` filter now fires on every successful submission and receives the `Submission` as a 4th argument.

Contact Form 7 → Core Forms migration tool

New page under Core Forms → Import that scans every `wpcf7_contact_form` post, converts shortcode markup to plain HTML (14 tag types covered), maps the CF7 mail template to a Send Email action, and carries `messages` overrides across as `cf_message*` post meta. Per-row preview lets you sanity-check before committing. Gravity Forms, WPForms, Fluent Forms, Ninja Forms, Formidable previewed as “Coming soon” cards.

Per-form analytics dashboard

New Analytics tab on every form-edit screen, powered by the existing `cf/v1/analytics/*` REST API: – One “Funnel” postbox with views, starts, submissions, spam. – SVG daily-activity chart with all three series overlaid. – Field interactions panel (where users focus/fill). – Top sources panel (UTM attribution with referrer-domain fallback). – Auto-generated recommendations — high spam rate, low completion, drop-off hotspots. – Date-range presets (7d / 30d / 90d / 1y) + custom from/to.

Form versioning + change history

The `core-form` post type now declares `’supports’ => […, ‘revisions’, …]`. `cf_settings`, `_cf_hidden_columns`, and every `cf_message` override persist alongside each revision. Settings-only or messages-only saves still create a revision (we force `wp_save_post_revision_check_for_changes` to `false` for `core-form`). New Revisions* tab lists each snapshot with author, timestamp, and a diff signal — restore drops back into the Core Forms admin with a flash and copies meta back automatically.

Security hardening — 14 audit findings fixed

  • CSRF on by default (existing installs preserved via 4.2.0 migration).
  • Submission mass-assignment closed via markup-derived allowlist.
  • Headless API key header-only; new CORS allowlist textarea.
  • Workflow `/actions/test` bumped to `manage_options`.
  • Webhook SSRF guard: `cf_is_safe_outbound_url()` rejects loopback / RFC1918 / link-local / IPv6 ULA / non-HTTP schemes.
  • Email header CRLF injection closed via `cf_esc_email_header()`.
  • Custom CSS `</style>` escape closed.
  • `process_save_form` inline cap+nonce check.
  • Two ghost `wp_ajax_*` handlers removed.
  • Polls trust `REMOTE_ADDR` only.
  • Draft saves rate-limited (30/IP+form/min).
  • File upload blocklist extended (html/htm/xhtml/xml/xsl/xslt).
  • Honeypot returns opaque success.

Admin redesign — WordPress-native everything

  • New plugin icon (Font Awesome Pro `pen-field`) across admin menu, block inserter, and editor placeholder.
  • Analytics + Revisions tabs use native WP chrome end-to-end — `.postbox`, `.wp-list-table widefat striped`, `.tablenav top`, `.row-actions`, native `.notice` variants.
  • Button styling unified — removed the `.button-primary` glow override that broke consistency.
  • Fullscreen / Typeform-style display mode promoted to its own top-level card on Settings.
  • WhatsApp actions surfaced in Add Action picker under new “Messaging & SMS” category.
  • Per-form Template picker unified with Add-New-Form gallery — all 12 templates available everywhere.

Headless `[CF_REFERRER_URL]` fix

Cross-origin Referer headers are stripped to the bare origin by browsers. The submit endpoint now reads `_cf_page_url` from the JSON body and substitutes it into `$_SERVER[‘HTTP_REFERER’]` for the duration of `Forms::process()`. Bundled embed.js forwards `window.location.href` automatically.

Build pipeline

Production builds run through `bash build.sh` which executes `composer install –no-dev` so dev-only autoload entries can’t leak. 148 unit tests pass; PHPStan clean against regenerated baseline; production zip 741KB.

Upgrade

Download the attached zip and upload via Plugins → Add New → Upload. Existing data, settings, and forms are preserved. The 4.2.0 migration runs automatically on first admin pageload after upgrade.

View Full Release History