4.2.0
Stable release. Consolidates eleven betas (`v4.2.0-beta` through `v4.2.0-beta11`) into one shipping version.
WhatsApp, three ways
Three new actions cover the full range of WhatsApp delivery models — pick whichever fits your existing stack.
- WhatsApp Cloud API action. Send template messages and free-form text (24-hour window) via Meta’s Graph API. Free tier covers 1,000 conversations per month. Credentials live globally under Settings → WhatsApp Cloud API with per-action override; a “Test connection” button reports the verified business name + quality rating.
- Twilio WhatsApp action. For shops already on Twilio — reuses your Account SID / Auth Token, posts to the `whatsapp:` channel, supports approved Content Template SIDs.
- Click-to-WhatsApp redirect. Generates a `wa.me` deep link with the submission pre-filled into the chat draft, used as the post-submit redirect.
Both Cloud API and Twilio sends log through Email Logs. The `cf_form_redirect_url` filter now fires on every successful submission and receives the `Submission` as a 4th argument.
Contact Form 7 → Core Forms migration tool
New page under Core Forms → Import that scans every `wpcf7_contact_form` post, converts shortcode markup to plain HTML (14 tag types covered), maps the CF7 mail template to a Send Email action, and carries `messages` overrides across as `cf_message*` post meta. Per-row preview lets you sanity-check before committing. Gravity Forms, WPForms, Fluent Forms, Ninja Forms, Formidable previewed as “Coming soon” cards.
Per-form analytics dashboard
New Analytics tab on every form-edit screen, powered by the existing `cf/v1/analytics/*` REST API: – One “Funnel” postbox with views, starts, submissions, spam. – SVG daily-activity chart with all three series overlaid. – Field interactions panel (where users focus/fill). – Top sources panel (UTM attribution with referrer-domain fallback). – Auto-generated recommendations — high spam rate, low completion, drop-off hotspots. – Date-range presets (7d / 30d / 90d / 1y) + custom from/to.
Form versioning + change history
The `core-form` post type now declares `’supports’ => […, ‘revisions’, …]`. `cf_settings`, `_cf_hidden_columns`, and every `cf_message` override persist alongside each revision. Settings-only or messages-only saves still create a revision (we force `wp_save_post_revision_check_for_changes` to `false` for `core-form`). New Revisions* tab lists each snapshot with author, timestamp, and a diff signal — restore drops back into the Core Forms admin with a flash and copies meta back automatically.
Security hardening — 14 audit findings fixed
- CSRF on by default (existing installs preserved via 4.2.0 migration).
- Submission mass-assignment closed via markup-derived allowlist.
- Headless API key header-only; new CORS allowlist textarea.
- Workflow `/actions/test` bumped to `manage_options`.
- Webhook SSRF guard: `cf_is_safe_outbound_url()` rejects loopback / RFC1918 / link-local / IPv6 ULA / non-HTTP schemes.
- Email header CRLF injection closed via `cf_esc_email_header()`.
- Custom CSS `</style>` escape closed.
- `process_save_form` inline cap+nonce check.
- Two ghost `wp_ajax_*` handlers removed.
- Polls trust `REMOTE_ADDR` only.
- Draft saves rate-limited (30/IP+form/min).
- File upload blocklist extended (html/htm/xhtml/xml/xsl/xslt).
- Honeypot returns opaque success.
Admin redesign — WordPress-native everything
- New plugin icon (Font Awesome Pro `pen-field`) across admin menu, block inserter, and editor placeholder.
- Analytics + Revisions tabs use native WP chrome end-to-end — `.postbox`, `.wp-list-table widefat striped`, `.tablenav top`, `.row-actions`, native `.notice` variants.
- Button styling unified — removed the `.button-primary` glow override that broke consistency.
- Fullscreen / Typeform-style display mode promoted to its own top-level card on Settings.
- WhatsApp actions surfaced in Add Action picker under new “Messaging & SMS” category.
- Per-form Template picker unified with Add-New-Form gallery — all 12 templates available everywhere.
Headless `[CF_REFERRER_URL]` fix
Cross-origin Referer headers are stripped to the bare origin by browsers. The submit endpoint now reads `_cf_page_url` from the JSON body and substitutes it into `$_SERVER[‘HTTP_REFERER’]` for the duration of `Forms::process()`. Bundled embed.js forwards `window.location.href` automatically.
Build pipeline
Production builds run through `bash build.sh` which executes `composer install –no-dev` so dev-only autoload entries can’t leak. 148 unit tests pass; PHPStan clean against regenerated baseline; production zip 741KB.
Upgrade
Download the attached zip and upload via Plugins → Add New → Upload. Existing data, settings, and forms are preserved. The 4.2.0 migration runs automatically on first admin pageload after upgrade.