v1.0.3

FE CSV Import & Export 1.0.3 is a security-focused release.

Security Fixes

• Blocked direct web access to uploaded import CSVs — uploaded CSV files are moved directly into a protected temporary directory with .htaccess/index.php guards and randomized names, instead of the public uploads/YYYY/MM/ path. A one-time cleanup also removes orphaned CSVs left behind by earlier versions.
• Prevented PHP object injection via imported custom field values — cf_ column values written to postmeta are validated so crafted serialized payloads cannot instantiate PHP objects.
• Neutralized spreadsheet formula injection in CSV exports — cells starting with =, +, -, @, tab, or carriage return (including cf_ headers) are prefixed with a single quote on export and restored on import.
• Applied kses to imported posts and meta for users without unfiltered_html — imported content is sanitized when the importing role cannot post unfiltered HTML.
• Applied the pre-import authentication filter on the import AJAX endpoint — fe_csv_import_export_pre_ajax_import now runs before file processing so Pro access checks cover the full import flow.

Bug Fixes

• Fixed import errors displaying as "undefined" in the log — server-side rejections (e.g., Pro re-authentication required) now display the actual error message.

Maintenance

• Added a release announcement workflow for the development release process.
• Development dependency updates via Dependabot.

Full Changelog: v1.0.2...v1.0.3