3.1.8.8
31. July 2026
Fixed an unauthenticated arbitrary password reset in the Pro Forms "Reset User Password" action
A published Pro Form using the Reset User Password action in Update mode could be used by an unauthenticated visitor to set the password of any account. The action now verifies ownership: a logged-in user changing their own password, a valid WordPress reset key, an account created by the same submission, or a user the visitor is allowed to edit. Reported by moonge via WPScan.
fix
[Pro Forms] Hardened the user and post actions against anonymous misuse
Update User, Update User Meta and Update/Delete Post now require that the submission owns the target (or that the site owner explicitly scoped the post type), instead of trusting an ID or email taken from a form field.
fix
[API Query Builder] Loading conditions now apply on archive pages (WooCommerce shop, CPT/date archives, search, 404)
fix
[Pro Forms] Fixed an "Undefined array key submitButtonConditionsRelation" warning on submit button conditions
fix
[Pro Forms] bricksforge_send_mail() now runs inside Custom Actions (REST requests)
fix
[General] External Files CSS: element styles are no longer lost when a post is saved outside the builder
fix
[Split Text] Restored word wrapping and overflow clip/reveal after the GSAP SplitText 3.15 update; property-less Lines actions run again
fix
[General] Fixed BRFPANEL being localised twice on the frontend (removed a duplicated ~107 KB inline payload)
fix
3.1.8.7
14. July 2026
Security Fix
Fixed a privilege escalation issue in the Pro Forms submission handling (CVE-2026-14956), reported to us through responsible disclosure.
fix
[Admin Pages] Hide an Admin Page from the WP admin sidebar Register an Admin Page without adding it to the sidebar — still reachable by direct link.
new
[Admin Pages] Added BRICKSFORGE_ADMIN_PAGE_CANVAS constant and bricksforge_is_admin_page_canvas() helper
new
[Submissions] CSV exports now respect column visibility and order
improvement
[Pro Forms] MailerPress status default now respects double opt-in
fix
[Pro Forms] Compatibility Fix for plugin "Payment Plugins for Stripe WooCommerce"
fix
3.1.8.6
30. May 2026
[Pro Forms] New AI Implementation (Beta)
The Bricksforge Assistant (AI) feature now comes with AI features for Pro Forms.
new
[Pro Forms] Added reactive disabled state for submit button
This option disables the submit button until all required fields have a value, and reactively re-enables it as the user types.
new
[Pro Forms] WooCommerce Product Gallery as Initial Files source
new
[Dynamic Data Tags] Added {brf_acf_user_field dynamic data}
Mirror of but for ACF user fields. Accepts :field_name:user_id and falls back to the current user when no id is given.