Skip to content

v2.8.8

Choose a tag to compare

View all tags
@RishadAlam RishadAlam released this 14 Jun 06:57
· 499 commits to main since this release
2.8.8
5ea3d3f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🧾 Changelog

Version: 2.8.8
Release Date: June 14, 2026

✨Security Fixes

  • Trigger Test Data: Gated test-data read/delete endpoints with capability checks.
  • SSRF & LFI: Blocked server-side request forgery and local file inclusion in file/upload fetching.
  • HappyForms: Hardened PHP object injection in the FallbackTrigger by restricting unserialize to non-object types.
  • Custom Function: Sanitized the custom-action file name on write to block path traversal.
  • GamiPress & FormCraft: Parameterized raw SQL queries to prevent SQL injection (Pro).
  • BuddyBoss, AppointmentHourBooking, FluentSMTP & HappyForms: Blocked PHP object injection by restricting unserialize to non-object types (Pro).

✨Improvements

  • Post content sanitization route generalized to cover all rich-content integrations (Mail, Telegram, WhatsApp, and more).

✨Bug Fixes

  • WordPress 5.1 compatibility: Replace WP 5.3/5.9 functions for WP 5.1 minimum support.
  • SureCart: Fixed checkbox fields missing from trigger payload (Pro).
Assets 3
Loading