ACPT - Custom post Types Plugin for Wordpress v2.0.67 Nulled

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.67 Nulled
## [2.0.67] - 2026-08-18

### Changed

#### Performance

- **License, plugin-version and ID-field-backfill options queried on every request** - These three tracking options were stored with `autoload=no`, forcing WordPress to issue a dedicated `SELECT` for each on literally every front-end and admin request instead of folding into its single bulk options query. Now stored autoloaded, with a one-time migration that fixes the flag on sites already storing these from an earlier version.
- **Settings table queried on every request without ever hitting the plugin's cache** - Reading the settings table happens during the plugin's own bootstrap, before its file-based query cache has been initialized, so this specific read could never benefit from it no matter how warm the cache was elsewhere. It now has its own lightweight cache, invalidated whenever a setting is saved.
- **`wp_enqueue_media()` running on every wp-admin screen** - ACPT called WordPress's media-library bootstrap function unconditionally on every `admin_enqueue_scripts`, triggering a `wp_posts` query on every wp-admin page for every plugin - not just ACPT's own screens. It's now only called on screens where ACPT actually registered assets.
- **Media library "date filter" dropdown query re-run on every `wp_enqueue_media()` call** - Hooked WordPress core's `media_library_months_with_files` filter (provided by core specifically to avoid this cost, see `core.trac.wordpress.org` ticket #31071) to cache the dropdown's month/year data instead of recomputing it with an uncached `wp_posts` scan every time.

### Fixed

#### Security

- **REST API authentication** - `ACPT_Api_Auth::authenticate()` only verified that Basic Auth credentials or an API key belonged to *some* valid WordPress user, without checking any capability - any authenticated user (including a Subscriber) could call every "secured" REST v1 route. Now requires `manage_options`, matching the plugin's own AJAX proxy. Reported by Patchstack.
- **SQL injection** - WooCommerce product-data field cleanup built its `DELETE` queries by string-concatenating client-supplied IDs into a `NOT IN (...)` clause with no escaping; a crafted ID could delete every row of the field table, not just orphans. Rebuilt with prepared-statement placeholders. Reported by Patchstack.
- **Privilege escalation** - A public form submission could set a client-controlled `acpt_form_user_id`/`_post_id`/`_term_id` field to update an *existing* WordPress user/post/term instead of creating a new one, with no ownership or capability check - an anonymous "create new user" form submission could overwrite an administrator account. Added `current_user_can()` checks before any update.
- **PHP Object Injection** - Hardened all 30 `unserialize()`/`maybe_unserialize()` call sites across the plugin (form metadata, relation-field sync, box/field-rename sync, form/block/permission builders, WooCommerce and WP All Import integrations) to reject embedded objects, closing a gadget-chain risk originally reported by Patchstack against 2 of these sites.
- **Stored XSS** - The meta-field sanitizer's allowed-tags list admitted `<script>`, so `wp_kses`-based sanitization never actually stripped it from rich-text field output.

#### Meta Fields

- **Site-wide crash from an invalid `save-meta-group` operator** - A `belongs` rule with a missing/empty operator could be persisted with an empty value and then crash *every* subsequent read of that structure (admin, front-end, REST, every Ability) as soon as it was re-hydrated from the database. The operator is now validated and invalid rules are rejected gracefully, both when saving and when reading a pre-existing row (Ticket #1182).
- **"Autoincrement" ID field never got a value outside wp-admin** - An ID-type meta field only ever generated its value inside the wp-admin edit-screen form; a post created via REST, the Abilities API, an import, or `wp_insert_post()` directly permanently had no value for that field. The value is now generated automatically on save regardless of how the post was created, and a one-time migration backfills every already-existing post on update (Ticket #1181).
- **`get_acpt_fields()` cross-box field collisions** - Fetching every field across a whole meta group (no specific box - the call ACPT's native Etch integration uses for `{options.acpt}`) could silently drop entire boxes' worth of data: fields were keyed by their position *within* their own box, which resets to 0 for every box, so a later box's fields overwrote an earlier box's fields at the same position (Ticket #1174).
- **Gallery field losing images on drag-reorder** - Dragging to reorder a Gallery field's images in wp-admin could silently drop entries: the preview only rendered a thumbnail for attachments that still resolved (e.g. not deleted from the media library since being selected), and reordering rebuilt the field's saved value from only the *rendered* thumbnails, discarding anything without one - occasionally emptying the field entirely. A Gallery field nested inside a Repeater/Flexible block had a second, more reliable trigger: reordering located the wrong field's hidden input as soon as a page had more than one gallery or rows were added/removed. Also fixed "hide unless this field has a value" conditional rules never correctly detecting an empty Gallery/Audio (multiple)/Video (multiple)/Image Slider field on the initial page render, only on later live updates. (Reported on Facebook)

#### Abilities API

- **`ability_invalid_output` on `rest_base`** - `list-post-types`/`list-taxonomies`/`get-taxonomy` could fail output validation for any taxonomy or post type registered without an explicit REST base (e.g. WP core's `link_category`/`post_format`), since `WP_Taxonomy`/`WP_Post_Type::$rest_base` defaults to the literal boolean `false`, not `string|null` as declared. Fixed at the read layer so already-stored data self-heals, not just new syncs.
- **`acpt/save-post-type` defaulting `capability_type` to the post slug** - A settings payload that omitted `capability_type` explicitly (rather than omitting `settings` entirely) defaulted it to the post type's own slug, generating meta capabilities never assigned to any role - the resulting CPT was registered but invisible in wp-admin and rejected edits for every role, including administrator. Default is now `post`, matching WP core (Ticket #1170).

#### Integrations

- **GenerateBlocks Dynamic Data for multi-value media fields** - Video (multiple), Gallery, Image Slider, and Audio (multiple) fields had no Dynamic Tag provider and never appeared as usable dynamic data; only their single-value counterparts were supported (Ticket #1175).
- **Windows image URLs** - Image/media field URL-building used `DIRECTORY_SEPARATOR` (a backslash on Windows) to join URL segments instead of a forward slash, silently breaking meta box saves on Windows hosts (Ticket #1173).

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.66 Nulled
## [2.0.66] - 2026-07-24

### Changed

- **Abilities API architecture** - Unified all ~41 abilities under a shared `AbstractAbility` base class (`src/Core/Ability/`), registered consistently through both the core WordPress Abilities API and the ACFW (agent-connector-for-wp) integration, with the same exception-handling, permission checks, and audit-log wrapping applied everywhere. Brings along the crash and data-loss fixes below.

### Fixed

- License page stuck unrecoverable after a site migration: when the stored activation id is no longer recognized by the license server (e.g. `Activation ID not found`), the React app silently discarded the error and always rendered the "Activate your license" screen with a dead (linkless) button, with no way to reach the "Deactivate license" action that would clear the stale local record. The fetch error is now surfaced and routes to the license details screen so it can be deactivated and re-activated normally.
- Fatal error on every request when license reconciliation can't reach acpt.io (e.g. cloned/staging domains) - the unguarded API call is now wrapped so a network failure degrades gracefully instead of fataling the whole site (Ticket #1164).
- CPT rewrite rules silently disabled when editing existing post types: the "Rewrite" toggle defaulted to unchecked for existing post types whose stored settings lacked an explicit `rewrite` key, so saving the form for any reason (e.g. just updating the front URL prefix) silently persisted `rewrite: false`, registering zero rewrite rules and 404ing the CPT - not fixable by flushing permalinks. Also hardens the `custom_rewrite`/front-URL-prefix priority check so a stale `custom_rewrite` value can no longer silently shadow the front URL prefix (regression of Ticket #1153, Ticket #1160).
- Image/media field values not saving when served from a different host (CDN, offloaded media, image accelerator, etc.) - attachment resolution now falls back to matching on the URL path alone when the host differs from the site's own upload base URL.
- Bricks Query Filter showed no checkbox options for POST_TYPE relation fields, and a cold indexer run could produce zero index rows; relational-loop dynamic data tags also resolved against the archive's queried object instead of the loop target (#1161, #1165).
- Site-wide crash (front-end, admin, REST, AJAX) from a missing/empty location-rule operator on `save-meta-group` - the operator is now validated and invalid rules are rejected gracefully.
- Partial updates across 8 ability families (Table, MetaField, FormField, DynamicBlock, TableGroup, Form, MetaBox, TableRecord) were silently deleting data the payload didn't mention - most seriously, omitting `columns` on a Table update deleted every column/index/foreign-key definition, and the next schema sync then dropped the corresponding database columns. All 8 now merge onto the existing record instead of rebuilding it from scratch.
- `save-meta-field` matched against the wrong data shape and never actually found the field being edited, so non-rename edits silently no-op'd and renames created orphan duplicates.
- ACFW's audit-logging/MCP registration always lost a boot-order race against the core Abilities API integration, so its decoration silently never applied when both were active.
- ACPT abilities were missing `meta.mcp.public`, so the official `wordpress/mcp-adapter` package (used by ACFW and other MCP host plugins) rejected every call with "not exposed via MCP" even though the ability registered fine.

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.65 Nulled
### Changed
- **Abilities API architecture** - Unified all ~41 abilities under a shared `AbstractAbility` base class (`src/Core/Ability/`), registered consistently through both the core WordPress Abilities API and the ACFW (agent-connector-for-wp) integration, with the same exception-handling, permission checks, and audit-log wrapping applied everywhere. Brings along the crash and data-loss fixes below.

### Fixed
- License page stuck unrecoverable after a site migration: when the stored activation id is no longer recognized by the license server (e.g. `Activation ID not found`), the React app silently discarded the error and always rendered the "Activate your license" screen with a dead (linkless) button, with no way to reach the "Deactivate license" action that would clear the stale local record. The fetch error is now surfaced and routes to the license details screen so it can be deactivated and re-activated normally.
- Fatal error on every request when license reconciliation can't reach acpt.io (e.g. cloned/staging domains) - the unguarded API call is now wrapped so a network failure degrades gracefully instead of fataling the whole site (Ticket #1164).
- CPT rewrite rules silently disabled when editing existing post types: the "Rewrite" toggle defaulted to unchecked for existing post types whose stored settings lacked an explicit `rewrite` key, so saving the form for any reason (e.g. just updating the front URL prefix) silently persisted `rewrite: false`, registering zero rewrite rules and 404ing the CPT - not fixable by flushing permalinks. Also hardens the `custom_rewrite`/front-URL-prefix priority check so a stale `custom_rewrite` value can no longer silently shadow the front URL prefix (regression of Ticket #1153, Ticket #1160).
- Image/media field values not saving when served from a different host (CDN, offloaded media, image accelerator, etc.) - attachment resolution now falls back to matching on the URL path alone when the host differs from the site's own upload base URL.
- Bricks Query Filter showed no checkbox options for POST_TYPE relation fields, and a cold indexer run could produce zero index rows; relational-loop dynamic data tags also resolved against the archive's queried object instead of the loop target (#1161, #1165).
- Site-wide crash (front-end, admin, REST, AJAX) from a missing/empty location-rule operator on `save-meta-group` - the operator is now validated and invalid rules are rejected gracefully.
- Partial updates across 8 ability families (Table, MetaField, FormField, DynamicBlock, TableGroup, Form, MetaBox, TableRecord) were silently deleting data the payload didn't mention - most seriously, omitting `columns` on a Table update deleted every column/index/foreign-key definition, and the next schema sync then dropped the corresponding database columns. All 8 now merge onto the existing record instead of rebuilding it from scratch.
- `save-meta-field` matched against the wrong data shape and never actually found the field being edited, so non-rename edits silently no-op'd and renames created orphan duplicates.
- ACFW's audit-logging/MCP registration always lost a boot-order race against the core Abilities API integration, so its decoration silently never applied when both were active.
- ACPT abilities were missing `meta.mcp.public`, so the official `wordpress/mcp-adapter` package (used by ACFW and other MCP host plugins) rejected every call with "not exposed via MCP" even though the ability registered fine.

Decryption key:

To view the content, you need to Sign In or Register.

# Changelog
## [2.0.65] - 2026-07-13
### Added
- Integration with the [Abilities API](https://docs.acpt.io/abilities-api), including output-schema fixes for `save-post-type` and 9 other providers whose output validation was broken.
- `append_acpt_meta_field_value()` function/ability to append a single Repeater row without resending existing ones - new `AppendMetaFieldRowCommand`, wired into the Abilities API as `acpt/append-meta-field-value`.
- New Table field arithmetic functions: `SQRT`, `ABS`, `MOD`, `MEDIAN`, `COUNT`.
- New telemetry insight keys (DB engine, multisite, active theme, PHP memory limit, WooCommerce version, feature usage counters) plus a deactivation ping.
### Fixed
- Table field `Maths` singleton memoization (was comparing flattened data against raw input, so caching never worked); malformed formulas (e.g. `=(ROUND("abc",2))`) now return a graceful error instead of crashing the live AJAX formula editor.
- CodeMirror text overflow in admin meta field editors - long lines/URLs now wrap instead of overflowing the layout.
- Etch fatal error when an Image field is nested inside a Repeater (`WPAttachment` private property access via `property_exists()`).
- Dynamic blocks not appearing/rendering in the FSE site editor.
- REST block-renderer live-preview error when inserting a dynamic block in the FSE site editor.
- ACPT loop fields empty on Bricks top-level term-archive templates.
- Front URL prefix causing 404s on Custom Post Type permalinks (Ticket #1153).
- WPML custom field translations getting stuck in one language (Ticket #1118).
- Image/Audio/Video/File field values silently not persisting to `wp_postmeta` via the REST save path: `WPAttachment::fromUrl()` now resolves attachments through query-string, URL-encoding, and `-scaled` suffix variants instead of only an exact `_wp_attached_file` match, and `ACPT_Api_Rest_Fields::updateCallback()` now returns a `WP_Error` when a field fails to save instead of silently discarding the failure.
### Changed
- Refactored `Request`: replaced ambiguous `has()` with explicit `hasGet()`/`hasPost()`; `all()` now delegates to `requestAll()`.

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.64
# Changelog

## [2.0.64] - 2026-06-25

### Fixed

- `PostField::renderRelationFieldSelector()` fatal error.
- `FORMAT_NATIONAL` fallback for PHP < 8.1 environments.
- `s.charAt` crash when Phone field has null `defaultValue` or Etch key in description.

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.63 Nulled
### Added
- New advanced option: `restrictLoggerUserPosts` in Post, Post multiple, and Relational fields.

### Changed
- Etch integration - no longer requires external patches; native `WPAttachment` conversion and filter fixes.
- Bricks: through-relationship dynamic data tags (up to 2 hops).
- Batch-prime WP post cache before gallery loops to eliminate N+1 queries.

### Fixed
- `Restrict image extensions` option was being polluted by `Input file accepts` values.
- Repeater sort blanked the second item - reindex regex extended to cover `_id` / `_required` hidden inputs.
- Field group for `product` post type was leaking onto the WooCommerce attribute edit page.
- PHPFastCache created per-host cache directories due to `HTTP_HOST` fallback; added cache folder setting.
- Logged-out users could bypass form role restrictions.
- DateTime picker always showed AM/PM regardless of the configured field format.
- `Url::fullUrl()` and `Url::baseUri()` no longer emit warnings in PHP CLI / WP-CLI / server-cron contexts.
- Gallery drag & drop lost attachment IDs after reorder.
- RankMath integration script no longer enqueued on the frontend.
- Meta box migrated to the wrong field group when saving an unrelated group.

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.62 Nulled
# Changelog

## [2.0.62] - 2026-05-18

### Added
- Add gallery lightbox support with GLightbox and fix inspector panel layout

### Fixed
- Table field settings and rendering
- Prevent raw HTML markup from showing in Gutenberg Preferences panel
- Allow Editors to access AJAX actions needed for post editing
- Flush phpfastcache on plugin upgrade to prevent stale serialized objects
- Gallery elements loop in GeneratePress PRO
- Resolve address field not working after selecting a search result

### Changed
- Removed tests files from bundle release

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.61 Nulled
# Changelog

## [2.0.61] - 2026-04-30

### Fixed
- Correct table data sanitization
- Prevent double-slashing of JSON values when saving option page meta
- Route `HTML_TYPE` through customWpKses and preserve base64 image validation in JSON sanitization
- Repeater field visibility conditions
- Set global $post in `set_loop_object()` so Bricks resolves post tags
- Add `flush_rewrite_rules()` after taxonomy save/delete to prevent 404 on front-end taxonomy URLs

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.60 Nulled
## [2.0.60] - 2026-04-29

### Fixed
- Move `sendInsights` to WP-Cron and add stampede guard
- Fix Bricks builder relational fields query loop
- Refresh user allcaps after `ACPT_Permissions::setPermissions()` so option page caps take effect immediately
- Resolve cURL timeout on plugin update by raising API timeout and capping failed-fetch cache TTL
- Fix import dataset files
- Fix media fields in Elementor PRO dynamic data
- Fix relational fields in repeaters — now populate correctly when added from cache

Decryption key:

To view the content, you need to Sign In or Register.

ACPT - Custom post Types Plugin for Wordpress v2.0.59 Nulled
## [2.0.59] - 2026-04-13

### Added
- Add `Video` multiple field
- Add Elementor PRO dynamic data provider test suite
- Add Elementor Widget test suite
- Add Bricks provider test suite
- Add gallery loop tag support
- Add form submission confirmation email with post URL

### Fixed
- Fix phone number national/international formatting for local and unrecognised numbers
- Fix email address validation before adding items in `InputMultiValue`
- Fix correct data fetch in Elementor PRO dynamic data provider
- Fix `stripslashes` breaking JSON strings in post meta

### Changed
- Cache and optimise `getAllAssociatedPostTypesAndTaxonomies`