Core Forms 4.4.2
Security
- Enforces the 254-character email limit and each field's declared
maxlengthon the server. - Rejects nested form values and encoded submission metadata above 60 KiB before hooks, storage, or notifications.
- Keeps uploaded file bytes outside that metadata ceiling; upload size remains controlled by the field and PHP limits.
Fixed
- Restores single and multiple multipart file uploads by normalizing PHP's
$_FILESdata into the submission pipeline. - Prevents invalid and spam submissions from moving files or persisting temporary upload paths.
- Fixes per-form rate-limit settings, hourly expiry, and AJAX error visibility.
See CHANGELOG.md for the full release history.