Release Notes

Stable release. Consolidates eleven betas (`v4.2.0-beta` through `v4.2.0-beta11`) into one shipping version.

WhatsApp, three ways

Three new actions cover the full range of WhatsApp delivery models — pick whichever fits your existing stack.

• WhatsApp Cloud API action. Send template messages and free-form text (24-hour window) via Meta's Graph API. Free tier covers 1,000 conversations per month. Credentials live globally under Settings → WhatsApp Cloud API with per-action override; a "Test connection" button reports the verified business name + quality rating.
• Twilio WhatsApp action. For shops already on Twilio — reuses your Account SID / Auth Token, posts to the `whatsapp:` channel, supports approved Content Template SIDs.
• Click-to-WhatsApp redirect. Generates a `wa.me` deep link with the submission pre-filled into the chat draft, used as the post-submit redirect.

Both Cloud API and Twilio sends log through Email Logs. The `cf_form_redirect_url` filter now fires on every successful submission and receives the `Submission` as a 4th argument.

Contact Form 7 → Core Forms migration tool

New page under Core Forms → Import that scans every `wpcf7_contact_form` post, converts shortcode markup to plain HTML (14 tag types covered), maps the CF7 mail template to a Send Email action, and carries `messages` overrides across as `cf_message*` post meta. Per-row preview lets you sanity-check before committing. Gravity Forms, WPForms, Fluent Forms, Ninja Forms, Formidable previewed as "Coming soon" cards.

Per-form analytics dashboard

New Analytics tab on every form-edit screen, powered by the existing `cf/v1/analytics/*` REST API: - One "Funnel" postbox with views, starts, submissions, spam. - SVG daily-activity chart with all three series overlaid. - Field interactions panel (where users focus/fill). - Top sources panel (UTM attribution with referrer-domain fallback). - Auto-generated recommendations — high spam rate, low completion, drop-off hotspots. - Date-range presets (7d / 30d / 90d / 1y) + custom from/to.

Form versioning + change history

The `core-form` post type now declares `'supports' => […, 'revisions', …]`. `cf_settings`, `_cf_hidden_columns`, and every `cf_message` override persist alongside each revision. Settings-only or messages-only saves still create a revision (we force `wp_save_post_revision_check_for_changes` to `false` for `core-form`). New Revisions* tab lists each snapshot with author, timestamp, and a diff signal — restore drops back into the Core Forms admin with a flash and copies meta back automatically.

Security hardening — 14 audit findings fixed

• CSRF on by default (existing installs preserved via 4.2.0 migration).
• Submission mass-assignment closed via markup-derived allowlist.
• Headless API key header-only; new CORS allowlist textarea.
• Workflow `/actions/test` bumped to `manage_options`.
• Webhook SSRF guard: `cf_is_safe_outbound_url()` rejects loopback / RFC1918 / link-local / IPv6 ULA / non-HTTP schemes.
• Email header CRLF injection closed via `cf_esc_email_header()`.
• Custom CSS `` escape closed.
• `process_save_form` inline cap+nonce check.
• Two ghost `wp_ajax_*` handlers removed.
• Polls trust `REMOTE_ADDR` only.
• Draft saves rate-limited (30/IP+form/min).
• File upload blocklist extended (html/htm/xhtml/xml/xsl/xslt).
• Honeypot returns opaque success.

Admin redesign — WordPress-native everything

• New plugin icon (Font Awesome Pro `pen-field`) across admin menu, block inserter, and editor placeholder.
• Analytics + Revisions tabs use native WP chrome end-to-end — `.postbox`, `.wp-list-table widefat striped`, `.tablenav top`, `.row-actions`, native `.notice` variants.
• Button styling unified — removed the `.button-primary` glow override that broke consistency.
• Fullscreen / Typeform-style display mode promoted to its own top-level card on Settings.
• WhatsApp actions surfaced in Add Action picker under new "Messaging & SMS" category.
• Per-form Template picker unified with Add-New-Form gallery — all 12 templates available everywhere.

Headless `[CF_REFERRER_URL]` fix

Cross-origin Referer headers are stripped to the bare origin by browsers. The submit endpoint now reads `_cf_page_url` from the JSON body and substitutes it into `$_SERVER['HTTP_REFERER']` for the duration of `Forms::process()`. Bundled embed.js forwards `window.location.href` automatically.

Build pipeline

Production builds run through `bash build.sh` which executes `composer install --no-dev` so dev-only autoload entries can't leak. 148 unit tests pass; PHPStan clean against regenerated baseline; production zip 741KB.

Upgrade

Download the attached zip and upload via Plugins → Add New → Upload. Existing data, settings, and forms are preserved. The 4.2.0 migration runs automatically on first admin pageload after upgrade.