Skip to main content

Core Forms

Core Forms 4.6 sells and licenses your plugins from inside WordPress

First post in this space, so here's where Core Forms actually stands. 4.6.0 shipped on 22 July, and it's a bigger jump than the version number suggests.

Core Forms now runs software licensing end to end. Products, plans, releases, orders, licenses, activations, subscriptions, and a customer dashboard, all native to WordPress. If you sell a plugin, a theme, or a digital download, you don't need a store plugin bolted onto a separate licensing service anymore.

What you get:

  • A licensing overview with store totals, setup readiness checks, and a persistent activity timeline
  • Searchable product, license, and order tables, plus a workspace per product for plans, releases, and customer setup
  • Release preflight that checks ZIP integrity, unsafe archive paths, plugin and theme headers, declared versions, and SHA-256 checksums before anything publishes
  • Seven Block Editor blocks and four shortcodes for catalogs, prices, buy buttons, checkout, and the customer dashboard
  • Currency-to-gateway routing, with ready-made forms for Stripe, PayPal, Razorpay, and Polar

Security got real attention in this one. Signed package URLs now identify a license by record ID instead of carrying the full key in the URL. Dashboard access requests return an identical response whether or not the email exists, so nobody can enumerate your customer list. REST and MCP responses never hand back gateway credentials or full license keys.

If you skipped 4.5.0, two things there matter. Forms got proper standalone pages at /collect/form-slug/, and asset loading got a lot stricter, so a basic form no longer drags the Smart Forms stylesheet onto the page with it. Old ?cf-form=slug links still work.

Update from your dashboard.

One thing I'd like tested: if you're shipping a plugin or theme through it, does release preflight reject anything it shouldn't? Unusual ZIP layouts and odd plugin headers are where I expect the edge cases to be, and that check runs right before you publish to real customers.