Core Forms 4.2 is out as of May 12, 2026, a day after 4.1. The change most people will notice is WhatsApp: a form can now send through Meta’s Cloud API or through Twilio, or hand the visitor straight into a WhatsApp chat with the submission already typed in. Alongside it are a Contact Form 7 importer, a per-form analytics tab, revisions for forms and a security pass that closed 14 audit findings.

This post covers the release and the 10 patch releases that followed it through May 16, because several of those added features of their own: a star rating field, a columns container, 5 new templates and a Polls menu inside Core Forms. Existing forms keep rendering as they did, and a few of the security changes deserve a look before updating, so they come first.

WordPress will offer the update under Dashboard, then Updates. The changelog carries the raw list. If something behaves differently from what is written here, the support page reaches me.

Before You Update

Nothing here breaks a form on its own, but each of these changes a default, and a site relying on the old default should know:

CSRF protection is on for new installs. Existing installs keep their previous value, because the 4.2.0 migration writes the explicit 0 into stored settings. Turning it on is wise, unless the page carrying the form is served from a full-page cache, where a stale nonce would reject real submissions. That case is the reason the migration preserves the old value.
The headless API key is header-only. The ?cf_key= query-string route is gone, because it leaked the key into server logs, browser history and Referer headers. Any client passing the key as a query parameter stops working until it moves the key to the header.
Settings, then Headless has a new Allowed origins box. Empty keeps the old behavior of reflecting any origin and shows an admin warning. Filling it is the fix.
The workflow /actions/test endpoint now needs manage_options instead of edit_forms, because it fires arbitrary action handlers with caller-supplied settings.
Polls trust REMOTE_ADDR only. A site behind a trusted reverse proxy opts back into forwarded headers with the cf_poll_trust_forwarded_for filter.
The upload blocklist now includes html, htm, xhtml, xml, xsl and xslt. A form that accepted XML uploads rejects them from this release.

What’s New in Core Forms 4.2

Six areas changed in this release. The WhatsApp work and the importer are the ones a site owner sees first, and the security pass is the one that matters most.

WhatsApp, Three Ways

Three new actions cover the ways a business actually uses WhatsApp, and you pick whichever fits the stack you already have.

The WhatsApp Cloud API action sends through Meta’s Graph API: template messages for a cold, business-initiated conversation, and free-form text inside the 24-hour customer-service window. Meta’s free tier covers 1,000 conversations a month. Credentials live under Settings, then WhatsApp Cloud API, with a per-action override, and a Test connection button reports the verified business name and quality rating before anything goes live.

The Twilio WhatsApp action is for shops already on Twilio. It reuses the Account SID and Auth Token, posts to the whatsapp: channel and supports approved Content Template SIDs for cold outreach.

The Click-to-WhatsApp redirect builds a wa.me deep link with the submission pre-filled into the chat draft and uses it as the post-submit redirect. For a lead-handoff form this is the useful one: the prospect lands in WhatsApp with your sales line already selected.

Both sending actions log through the existing Email Logs table, with whatsapp_cloud and twilio_whatsapp as the action type. The cf_form_redirect_url filter now fires on every successful submission, not only when a per-form redirect is configured, and receives the submission as a fourth argument.

Contact Form 7 Importer

The new Import page scans every wpcf7_contact_form post and converts it. Shortcode markup becomes plain HTML for 14 tag types: text, email, tel, url, number, date, hidden, textarea, select, checkbox, radio, acceptance, file and submit. The CF7 mail template becomes a Send Email action, and _messages overrides carry across as cf_message_* post meta.

Each row in the importer table has a “Preview converted HTML” disclosure, so you can check the result before committing. CF7 stays installed and untouched, which means the switch is reversible until you decide it is done.

Per-Form Analytics Tab

Every form-edit screen gains an Analytics tab, built on the cf/v1/analytics REST API that already existed. A Funnel box shows views, starts, submissions and spam above an SVG chart of daily activity. Two side panels list field interactions, meaning where visitors focus or fill, sorted by frequency, and top sources, using UTM attribution when it is there and the referrer domain otherwise.

A recommendations panel turns that into plain suggestions: a high spam rate, low completion, a drop-off hotspot. Date presets of 7, 30, 90 days and a year sit next to custom from and to inputs, and changing the range does not reload the page.

Form Revisions

The core-form post type now supports revisions, and every save creates one, including a save that only changed settings or messages. WordPress normally skips a revision when the post content has not changed, so 4.2 forces that check off for forms and persists _cf_settings, _cf_hidden_columns and every cf_message_* override alongside each snapshot.

A Revisions tab lists each snapshot with the author, a relative timestamp and a small diff signal: title changed, plus or minus a character count, or no markup change. From there you open WordPress’s native side-by-side diff or restore the snapshot with a confirmation. A restore returns you to the Core Forms admin with a success notice and copies the meta back to the parent form on its own.

Security Hardening

A security audit produced 14 findings and this release closes all of them:

CSRF protection on by default for new installs, with existing installs preserved through a migration.
Submission mass-assignment closed. Processing intersects POST keys with the field names declared in the form’s markup, filterable through cf_allowed_field_names for extensions that add fields outside the static markup.
Headless API key header-only.
Headless CORS allowlist through the new Allowed origins setting.
The /actions/test route raised to manage_options.
A webhook SSRF guard through the new cf_is_safe_outbound_url(), rejecting loopback, RFC1918, link-local and IPv6 unique-local ranges and non-HTTP schemes such as file:// and gopher://. Webhook auth header names and values also strip CR and LF.
Email header CRLF injection closed. The new cf_esc_email_header() replaces strip_tags on every header substitution in the Email, Emailit and Autoresponder actions, so a submitter posting me@x.com\r\nBcc: victim@example.com into an [email]-substituted header no longer adds a recipient.
The custom CSS </style> escape closed. The old regex did not consume the closing >, so </style><img onerror=...> survived into the page as stored XSS.
process_save_form gained an inline capability check and nonce check as defense in depth.
Two ghost wp_ajax_* handlers removed. Their target methods did not exist, so calling them returned a fatal.
Polls trust REMOTE_ADDR only.
Draft saves rate-limited to 30 new drafts per IP and form per minute, filterable through cf_draft_save_rate_limit.
The file upload blocklist extended with html, htm, xhtml, xml, xsl and xslt. This closes a stored-XSS path on nginx, which ignores the uploads .htaccess and would serve an uploaded HTML file as text/html on the WordPress origin.
The honeypot returns an opaque success on a missing or populated field instead of WordPress’s silent 0, so a bot can no longer tell “rejected” from “accepted but never processed”.

WordPress-Native Admin

Core Forms has a new icon: pen-field from Font Awesome Pro 7.2, a square frame holding an input row and a pen. It is the same glyph in the admin sidebar, the block inserter and the in-editor placeholder.

The Analytics and Revisions tabs use WordPress’s own chrome from end to end: .postbox containers, wp-list-table for data, .tablenav for the analytics toolbar, .row-actions on revision rows and the native .notice variants for empty states and recommendations. Button styling is unified across every screen, and the brand-colored glow that made Save Form look unrelated to Refresh and Restore on the same page is gone.

Display mode, the Typeform-style fullscreen option, moved from a buried Add-ons row to a card at the top of the Settings tab, and a fullscreen form now shows its standalone URL in the form-edit header with a copy control and an Open button. The three WhatsApp actions sit under a new Messaging & SMS category in the Add Action picker beside Twilio SMS; they had been registered but hidden because the picker only listed types from a static map. The per-form template picker reads the same registry as the Add New Form gallery, so all 12 templates are available in both places instead of 5 hardcoded ones.

Smaller Changes and Fixes

Headless [CF_REFERRER_URL] fixed. Browsers strip a cross-origin Referer to the bare origin, so the variable resolved to the REST endpoint’s own URL. The submit endpoint now reads _cf_page_url from the JSON body, and the bundled embed.js forwards window.location.href on its own.
Production builds go through bash build.sh, which runs composer install --no-dev so dev-only autoload entries cannot reach the deployed autoloader. The PHPStan baseline was regenerated, 148 unit tests pass and the production ZIP is 744 KB with no test framework, no PHPStan and no composer.json.
Buttons pairing a dashicon with text sat about 2px high on WordPress 6.9. A scoped rule fixes the baseline on versions before 7.0.

The Patch Releases

Ten patch releases followed in 4 days, and most of them are small, but 4.2.4 and 4.2.8 are features that would have been a release of their own in a slower month.

4.2.1

May 12, 2026. The per-form spam view routes correctly. The form-edit router now branches on form_id instead of view=edit, so view=spam, view=all and view=inbox all open the Submissions tab. The submissions list lost the inset left border on new and spam rows and the muted text on spam; status reads from the badge column alone.

4.2.2

May 14, 2026. The headless embed no longer shows “[object Object]” as the success message. embed.js now reads .text from the processor’s structured message object.

4.2.3

May 14, 2026. A demo-mode guard for the public Playground demo. When CF_DEMO_MODE is defined in wp-config.php, the plugin refuses to boot outside a playground.wordpress.net sandbox.

4.2.4

May 14, 2026. The largest of the patches:

A .cf-rating star rating field: a radio-based 1 to 5 picker with CSS-mask icons, a reverse-order cascade, keyboard reach and a screen-reader label per star. Code mode gets an “Insert star rating” toolbar button.
A Create Comment / Review action that posts a submission as a WordPress comment, stores the rating as comment meta and recomputes cf_rating_average and cf_rating_count on the post. It hooks transition_comment_status, so moderating a comment keeps the aggregate right.
5 starter templates: Product review, Lightweight comment form, NPS survey, Bug report and Product waitlist.
A .cf-row columns container driven by inline CSS variables (--cf-cols, --cf-cols-t, --cf-cols-m, --cf-gap) for up to 6 columns per breakpoint, with a code-mode “Insert columns row” inserter.
Real-time preview sync. The code-mode textarea pushes markup to the preview iframe on every keystroke with a 180ms debounce, through postMessage scoped to the origin and the form ID.
A template preview iframe modal in the template chooser.

4.2.5

May 14, 2026. The template preview handler is registered in the AJAX branch, where it had been gated behind a ! DOING_AJAX check that stopped it from ever wiring. Create Comment appears in the Actions picker under the WordPress category. Every starter template now lands with a default “Email the admin” action, and the product review and page comment templates ship with Create Comment pre-wired.

4.2.6

May 14, 2026. The per-form template chooser on the Fields tab carries a Preview pill on each card.

4.2.7

May 14, 2026. Polls moved under the Core Forms admin menu as two entries, Polls and Add Poll, with a parent-file filter keeping Core Forms highlighted on poll screens. This release also bundled a rollup of smaller changes from the 4.2.1 to 4.2.7 line:

The form editor preview enqueues forms.css and form-theme.css with the theme token overrides, so the canvas and the code-mode iframe match the front end.
The global stylesheet settings say what each file does: Skeleton CSS is forms.css, Default form theme is form-theme.css, and each is Load or Skip.
After Submission is a two-way choice, Show message or Redirect to URL, with the redundant “Redirect to a page” option removed and contextual help per selection.
Create Post and Create Article merged. CreateArticle owns the create_post slug and the old create_article type is forwarded at runtime.
The per-form Settings tab opens with only the first accordion expanded. “Add-ons” became “Extras” in the Settings and Messages labels.
wp_die() in the template preview passes HTTP codes through the response argument, so unauthorized hits return a real 403, 400 or 404.
The localized cfFormTemplates object carries a preview_url per template, and window.CoreFormsAdmin.openTemplatePreview(id, label) is exposed for programmatic use.

4.2.8

May 14, 2026. Selecting a Container on the Fields tab reveals a Layout panel in the inspector: desktop, tablet and mobile column counts from 1 to 6, plus a gap. The settings persist on the field and emit as the same inline CSS variables the front end reads, and the canvas applies them to the container body so the drag-and-drop area shows the configured columns instead of a stacked list. New containers started with 2 columns in this release.

4.2.9

May 15, 2026. The container “Add field” popover was redesigned as a fixed 360px panel with a header bar, a 4-column icon grid and a close button, and it dismisses on outside click or Escape instead of floating over the canvas. New containers now default to a single column, and a grid is something you opt into from the Layout panel. Column changes preview in real time, and empty containers show a dashed outline at rest and a solid blue highlight while dragging. Two PHPStan errors that were blocking the release pipeline were cleared.

4.2.10

May 16, 2026. The Duplicate row action on the forms list duplicates the form. It used to drop you into the editor for the original, because the duplicate URL carries a form_id and the overview page opened the editor before the list table could run its handler. The overview now processes action=duplicate_single first, clones the form and returns to the list.

The Limits

The Cloud API action works inside Meta’s rules, not around them. A cold message needs an approved template, and free-form text only goes out inside the 24-hour window after the customer wrote to you.

The importer reads Contact Form 7 only in this release. Importers for other form plugins are on the roadmap.

Revisions capture the form, its settings and its messages. They do not capture submissions, so restoring an older form does not touch the inbox.

The analytics tab shows what the tracker has collected. A form that had analytics off has no history to show.

Docs and Links

Core Forms 4.2 in the changelog, with every patch beneath it.
WhatsApp Cloud API, Twilio WhatsApp and Click-to-WhatsApp.
Moving from Contact Form 7.
Form analytics and containers in the builder.
The previous release, Core Forms 4.1.

Final Remarks

If you have updated, the plugin now defaults to the safer setting in every place the audit looked, and the admin looks like the rest of WordPress instead of a plugin living inside it. The idea to keep is that a default is a decision. Most of the 14 findings were old defaults nobody had revisited.

If your install predates this release, three settings are worth a look. Turn on CSRF protection under Settings if the pages carrying your forms are not served from a full-page cache. Fill in Allowed origins if you use the headless API, because the empty box still reflects any origin. And run the Contact Form 7 importer with the preview open before removing anything, since CF7 stays installed and there is no hurry.

The integration pages walk through each WhatsApp route, and the support page is there for whatever this post did not cover.

That covers 4.2. I hope the quieter admin grows on you.

Core Forms 4.2