Fixed an unauthenticated arbitrary password reset in the Pro Forms "Reset User Password" action
A published Pro Form using the Reset User Password action in Update mode could be used by an unauthenticated visitor to set the password of any account. The action now verifies ownership: a logged-in user changing their own password, a valid WordPress reset key, an account created by the same submission, or a user the visitor is allowed to edit. Reported by moonge via WPScan.
fix
[Pro Forms] Hardened the user and post actions against anonymous misuse
Update User, Update User Meta and Update/Delete Post now require that the submission owns the target (or that the site owner explicitly scoped the post type), instead of trusting an ID or email taken from a form field.
fix
[API Query Builder] Loading conditions now apply on archive pages (WooCommerce shop, CPT/date archives, search, 404)
fix
[Pro Forms] Fixed an "Undefined array key submitButtonConditionsRelation" warning on submit button conditions
fix
[Pro Forms] bricksforge_send_mail() now runs inside Custom Actions (REST requests)
fix
[General] External Files CSS: element styles are no longer lost when a post is saved outside the builder
More: https://forum.bricksforge.io/t/pro-forms-css-not-rendering-with-external-file-css-rendering/5195
fix
[Split Text] Restored word wrapping and overflow clip/reveal after the GSAP SplitText 3.15 update; property-less Lines actions run again
More: https://forum.bricksforge.io/t/spli...ds-to-break-unexpectedly-version-3-1-8-6/5103
fix
[General] Fixed BRFPANEL being localised twice on the frontend (removed a duplicated ~107 KB inline payload)
More: https://forum.bricksforge.io/t/brfp...load-duplicated-in-frontend-html-3-1-8-7/5204
Security Fix
Fixed a privilege escalation issue in the Pro Forms submission handling (CVE-2026-14956), reported to us through responsible disclosure.
fix
[Admin Pages] Hide an Admin Page from the WP admin sidebar Register an Admin Page without adding it to the sidebar — still reachable by direct link.
new
[Admin Pages] Added BRICKSFORGE_ADMIN_PAGE_CANVAS constant and bricksforge_is_admin_page_canvas() helper
new
[Submissions] CSV exports now respect column visibility and order
improvement
[Pro Forms] MailerPress status default now respects double opt-in
fix
[Pro Forms] Compatibility Fix for plugin "Payment Plugins for Stripe WooCommerce"
fix
[Pro Forms] New AI Implementation (Beta)
The Bricksforge Assistant (AI) feature now comes with AI features for Pro Forms.
new
[Pro Forms] Added reactive disabled state for submit button
This option disables the submit button until all required fields have a value, and reactively re-enables it as the user types.
new
[Pro Forms] WooCommerce Product Gallery as Initial Files source
new
[Dynamic Data Tags] Added {brf_acf_user_field dynamic data}
Mirror of but for ACF user fields. Accepts :field_name:user_id and falls back to the current user when no id is given.
new
[Pro Forms] Added "Flexible" size option for the Turnstile element.
new
[General] Updated GSAP & Plugins to latest versions
improvement
[Pro Forms] Fixed direct-upload files being lost on re-submission after validation errors.
fix
[Pro Forms] Email Action: wpautop fix
fix
[Pro Forms] Stripe/Mollie API key lookup failing on some hosting environments
fix
[Pro Forms] Skip validation for nested fields in hidden steps
fix
[Pro Forms] Render dynamic data in Pro Forms file download manual URL
fix
[Pro Forms] Step indicators not keyboard-accessible when clickable
fix
[Pro Forms] Required fields not enforced when skipping ahead via Step click
fix
[Pro Forms] Contact not added to MailerPress list when Mollie is active
fix
[Pro Forms] Multi-file values not saving to flat meta keys
fix
[Pro Forms] Initial Files failing for scaled images
fix
[Pro Forms] Restricted BRFPANEL frontend output to only essential properties.
fix
[Page Transition] Fixed page not scrolling to top after page transition in some situations.
fix
[General] Minor Bug Fix with the Pro Forms Element Toggle in the Backend
[General] Fixed PHP Warnings
[Admin Pages] Bricks 2.2 Compatibility Fix
[Backend Designer] Bricks 2.2 Compatibility Fix
[General] Fixed PHP Warnings
fix
[Admin Pages] Bricks 2.2 Compatibility Fix
fix
[Backend Designer] Bricks 2.2 Compatibility Fix
fix
[Page Transitions] Fixed issues with "Play on Initial Page Load" not firing
[Pro Forms] Fixed File Upload MIME Type Validation Issues related to ZIP Files
fix
[Pro Forms] Improved Cron Job to clear temp files