Gatilab Products

Changelogs

Improvements, fixes, and the details behind each release.

Core Forms

Build forms, collect submissions, and connect the actions your site needs.

View Product
Beta

Core Forms 4.0.0-b5

Read release notes

Core Forms 4.0.0-b5

What's New

Schema-backed Form Engine - JSON form schema with versioning, migration from legacy HTML - Visual ↔ Code bidirectional sync (edit HTML, updates visual builder and vice versa)

Visual Form Builder - React-based 3-column layout: inserter | canvas | inspector - 25+ field types, drag-and-drop reordering, container/fieldset nesting - 6 starter templates, inline preview, fullscreen preview modal

Smart Form Features - Multi-step forms with progress bar and step validation - Save & resume via tokenized draft links - Field calculations (safe parser, no eval) - Form scheduling (date/time/day-of-week windows) - Conditional logic with 14 operators and grouped AND/OR rules - Inline validation with accessible error messages

21 Integrations - Notifications: Email, Autoresponder, Slack, Discord, Telegram, Twilio SMS - Marketing/CRM: Mailchimp, ConvertKit, ActiveCampaign, Brevo, Drip, MailerLite, HubSpot, FluentCRM - Data: Google Sheets, Notion, Airtable - Automation: Webhooks, Zapier, Make - WordPress: Create User, Create Post, Create Article/CPT with ACF mapping

Workflow Automation - Async action queue with background processing - Automatic retries with exponential backoff - Action logs with structured execution tracking - Webhook HMAC-SHA256 signatures

Analytics - Form views, starts, submissions, abandonments tracking - Field-level drop-off analysis - UTM and referrer attribution - Auto-generated recommendations

Native Block Editor - ServerSideRender live preview in editor - Form picker with InspectorControls - Shortcode transform, block variations - Spacing and alignment supports

Security - 50+ bugs found and fixed across 6 audit rounds - Upload hardening (MIME validation, 30+ blocked extensions) - PHPUnit (114 tests), PHPStan level 5, ESLint - ABSPATH guards, input sanitization, output escaping

Documentation - 61 markdown files, 11,000+ lines - Getting started, form builder, smart forms, integrations, workflows, analytics, developer docs

Requirements

  • WordPress 6.0+
  • PHP 7.4+
Stable

Core Forms 3.5.0

Read release notes

What's New

REST API

  • Full CRUD REST API for submissions at cf/v1 namespace
  • Collection endpoints with pagination, filtering by status/spam/date/search
  • Status validation returns proper 400/404 errors

Submission Status Tracking

  • New status field: new, read, replied, archived
  • Auto-marks submissions as "read" when viewed
  • Auto-marks as "replied" after sending a reply
  • Bulk status actions in the submissions table
  • Status badges in the global submissions view

Conditional Actions

  • Run form actions only when field conditions are met
  • Operators: equals, not equals, contains, does not contain, is empty, is not empty
  • AND logic — all conditions must match for the action to fire

Spam Protection

  • Akismet whitelist keywords — bypass spam checks for trusted submissions
  • Configurable in Settings → Spam Protection

Quality of Life

  • One-click form duplication from the forms list
  • Status column included in CSV exports
  • Polls database tables now created on activation/migration
  • Consistent border-radius across admin UI

Security Fixes

  • Escaped all HTML name attributes in condition row output (XSS)
  • Added capability check to form duplication handler
  • REST API validates status values on update
Stable

Core Forms 3.4.0

Read release notes

What's New

Emailit Integration

  • Send Email via Emailit — New action to send form notification emails through the Emailit API instead of wp_mail()
  • Emailit Subscribe — Add contacts to Emailit audiences on form submission, with multi-audience support and custom field mapping
  • Settings — Emailit API key configuration in global settings

Data Variable Fixes

  • Fixed [all:label] — was silently broken (never implemented). Now renders all submission fields with human-readable labels extracted from form HTML
  • Fixed [all], [CF_FORM_ID], [CF_FORM_TITLE] — also previously non-functional
  • Rewrote cf_replace_data_variables() with clean switch-based implementation

Auto-Fill Action Defaults

  • All actions (Email, Autoresponder, MailerPress, Emailit, Emailit Subscribe) now auto-detect field names from form HTML markup when first created
  • No more manually typing [EMAIL], [FIRST_NAME], etc. — fields are pre-populated

Full Changelog