Skip to content

Super Forms 6.4.008 (beta)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@RensTillmann RensTillmann released this 02 Oct 00:24
· 207 commits to stable since this release
v6.4.008
2e2d7ba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Super Forms 6.4.008 (beta line) is a security release. It brings the full stable 6.3.318 security hardening to the 6.4 line and fixes multi-step form validation.

Update recommended for every site running 6.4.001 to 6.4.007. Sites on 6.4.x receive this update automatically through the Super Forms update channel. Sites on 6.3.x stay on the 6.3 line (6.3.320).

Security

  • Fixes the unauthenticated file read (CVE-2026-28167), arbitrary directory deletion (CVE-2026-17609) and upload extension bypass (CVE-2026-17196) on the 6.4 line. On the stable line these were fixed in 6.3.317.
  • Form file uploads, generated file downloads, account registration and updates, Listings entry actions, form administration, contact entry imports and exports, WooCommerce order search, unique code and invoice number generation, PayPal payment notifications and Mailchimp form data are all hardened.
  • Text a visitor types into a form field is always treated as plain text. {tags}, [shortcodes] and e-mail foreach/if code inside submitted values are never resolved or run. Tags and shortcodes you configure in your own forms and e-mail templates keep working.
  • No PHP objects are created from submitted serialized strings (Front-end Posting, Register & Login, Mailchimp, Mailster, MailPoet).
  • The "users" retrieve method shows only public name fields to visitors. A new super_users_retrieve_allowed_fields filter controls which fields are allowed.
  • Updates are fetched over HTTPS and installed only from trusted hosts (super_forms_trusted_update_hosts filter). The Licenses screen requires the Administrator capability.

Changed

  • WooCommerce Order Search shows orders only to shop staff, and to logged-in customers for their own orders (super_wc_order_search_scope filter).
  • Unique codes and invoice numbers are reserved when the form is submitted. The code shown while filling in the form is a preview.
  • PayPal payments are linked to their entry, post and user through a signed reference. Payments started before this update are still recorded, but they don't change any status automatically.
  • {tags} in form shortcode parameters now pre-fill the field literally. Put the tag in the field's own Default value instead.

Fixed

  • Multi-step forms wait for asynchronous validation before switching steps (#3524).
  • Assorted fixes for Listings, stored files, Stripe checkout, rewrite rules after updating, Google Sheets on older PHP versions, and date validation.

Requires PHP 7.4 or newer. The full changelog is in src/docs/changelog.md.

SHA-256 (super-forms-6.4.008.zip): see super-forms-6.4.008.zip.sha256.

Assets 4
Loading