Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

WCFM · Version history

WCFM changelog and version history

Latest version
6.8.2
Nov 2, 2026 (7 days ago)
Releases
277
since 2017
In the last year
10
about one every 39 days
Tested up to
WordPress 7.1.4
PHP 7.4 or later

Releases each year

  • 201787 releases
  • 201875 releases
  • 201945 releases
  • 202019 releases
  • 202111 releases
  • 20225 releases
  • 20238 releases
  • 202410 releases
  • 202510 releases
  • 20267 releases

20267 releases

  1. WCFM 6.8.2Latest

    • Updated – 02/11/2026
    • Security – Fixed a Stored Cross-Site Scripting (XSS) vulnerability in dashboard notifications. Reported by Sawyer and AndrewN (Patchstack).
    • Security – Fixed a Missing Authorization vulnerability in the inquiry form, which ignored the “Inquiry with login” setting and accepted any store or product ID. Reported by Intrudify (Patchstack).
    • Security – Fixed a Missing Authorization vulnerability in product saving, which let a vendor edit other vendors’ products and variations or delete any post. Reported by Niv Kochan and Matan Bachar (Wordfence).
    • Security – Fixed a Missing Authorization vulnerability in the capability settings save, which let vendors and their staff change the site-wide capability settings of all vendors, shop managers and shop staff.
    • Security – Fixed a Reflected Cross-Site Scripting (XSS) vulnerability in the customer details and notice manage dashboard endpoints. Reported by neurotx.
    • Security – Hardened the store settings and profile saves against the Stored Cross-Site Scripting (XSS) vulnerability in the vendor store phone and social profile fields, which is fixed in WCFM Marketplace 3.8.4: the store phone, email, customer support details and social profile links are now saved…
    • Security – Hardened the store settings save against the Stored Cross-Site Scripting (XSS) vulnerability in the store video banner, which is fixed in WCFM Marketplace 3.8.4: the video banner and store list video banner are now saved as URLs, without HTML. Reported by mroccon (Patchstack).
    • Security – Fixed an Incorrect Privilege Assignment vulnerability: with WooCommerce Appointments active, vendors were given the site-wide manage_options capability, and kept it after Appointments was deactivated. Updating removes it from the vendor and shop staff roles.
    • Fix – Rewrite rules are no longer flushed on every request.
    • Fix – Product categories, tags and custom taxonomies are now saved in one step, so a deleted category no longer leaves “Uncategorized” on the product.
    • Enhance – WooCommerce 11.2+ compatibility check added
    • Enhance – WordPress 7.1+ compatibility check added

  2. WCFM 6.8.1

    • Updated – 25/08/2026
    • Security – Fixed an Insecure Direct Object Reference (IDOR / CWE-639) vulnerability that allowed an authenticated vendor to submit a withdrawal request against another vendor’s commission and have the payout credited to their own account, reported by Shikhali Jamalzade, Credit goes to Shikhali Jama…
    • Fix – Withdrawal requests now re-validate every submitted commission against the requesting vendor’s own withdrawable commissions, so ineligible, already-requested or other vendors’ commissions can no longer be submitted or double-spent.
    • Fix – Prevented stray backslashes from being stored in enquiry replies, enquiry submissions, and dashboard notifications.
    • Fix – Hardened output escaping and removed redundant markup in several dashboard report and manager templates.
    • Enhance – WooCommerce 11.0+ compatibility check added

  3. WCFM 6.8.0

    • Updated – 27/07/2026
    • Security – Fixed an IDOR vulnerability in vendor inquiry replies, preventing unauthorized access to other vendors’ inquiries.
    • Enhance – Added support for the new Stripe Split Pay engine in vendor payment settings (WCFM Marketplace v3.8.0)
    • Enhance – Persist Stripe Connect onboarding data required by the new Stripe Split Pay engine.

  4. WCFM 6.7.28

    • Updated – 27/06/2026
    • Security – Fixed an Unauthenticated Authorization Bypass vulnerability that allowed arbitrary reply injection into store inquiries and unsolicited notification emails.
    • Security – Fixed an Insecure Direct Object Reference (IDOR) vulnerability that allowed authenticated vendors to archive products, toggle featured listings, mark orders complete, and delete inquiries and messages belonging to other vendors.
    • Enhance – Added developer hooks to add a custom column to the Vendors list (wcfm_vendors_custom_column_header, wcfm_vendors_custom_column_data_after, plus filterable DataTable column config).
    • Enhance – Added action hooks to the Article manager view (before_wcfm_article_manage_action, after_wcfm_article_manage_action, wcfm_article_manager_featured_image_field_end).
    • Enhance – Added the wcfm_dashboard_after_limit_stats hook and refreshed the Dashboard welcome box to a responsive layout.
    • Enhance – WooCommerce 10.8+ compatibility check added
    • Enhance – WordPress 7.0+ compatibility check added

  5. WCFM 6.7.27

    • Updated – 25/04/2026
    • Enhance – PHP compatibility expanded: now supports versions 7.2–8.4

  6. WCFM 6.7.26

    • Updated – 16/03/2026
    • Security – Fixed an Authenticated IDOR vulnerability allowing unauthorized user deletion. Reported by Supakiad S. (m3ez).
    • Security – Fixed an Authenticated IDOR vulnerability allowing unauthorized post/product manipulation. Reported by Osvaldo Noe Gonzalez Del Rio.
    • Fixed – Replaced deprecated $order->ID with $order->get_id() in order controllers to ensure compatibility with HPOS. Credit: roeller
    • Enhance – WooCommerce 10.6+ compatibility check added

  7. WCFM 6.7.25

    • Updated – 07/02/2026
    • Fixed – Authenticated (Shop Manager+) Arbitrary Options Update vulnerability reported by Osvaldo Noe Gonzalez Del Rio, Credit goes to Osvaldo Noe Gonzalez Del Rio for identifying this issue.
    • Fixed – Broken Access Control vulnerability reported by benzdeus, Credit goes to benzdeus for identifying this issue.
    • Enhance – Hardened Access Control (IDOR Protection) by introducing wcfm_user_can_perform_request() to validate resource ownership across the dashboard.
    • Enhance – Secured notification message deletion.

202510 releases

  1. WCFM 6.7.24

    • Updated – 20/12/2025
    • Fixed – PHP ‘Undefined index’ notice fixed in wcfm_save_page_analytics_data().
    • Enhance – WordPress 6.9+ compatibility check added
    • Enhance – WooCommerce 10.4+ compatibility check added

  2. WCFM 6.7.23

    • Updated – 07/12/2025
    • Fixed – Allow access to wcfm pages for super admins in multisite setup.
    • Fixed – PHP Deprecated warnings & minor fixes.

  3. WCFM 6.7.22

    • Updated – 12/11/2025
    • Fixed – Prevent custom taxonomy terms from persisting if their values are not submitted (i.e., all terms are deselected) upon product save.
    • Enhance – WordPress 6.8+ compatibility check added
    • Enhance – WooCommerce 10.3+ compatibility check added

  4. WCFM 6.7.21

    • Updated – 13/07/2025
    • Fixed – Added a new custom capability for site Setup page access

  5. WCFM 6.7.20

    • Updated – 02/07/2025
    • Fixed – Setup page access is now controlled via user capabilities. Added filter wcfm_setup_page_required_capability to customize required capability. Removed deprecated filter wcfm_allow_setup_page_access

  6. WCFM 6.7.19

    • Updated – 14/06/2025
    • Enhance – WooCommerce 9.9+ compatibility check added
    • Enhance – Compatibility with German Market version 3.47
    • Fixed – Store Manager dashboard settings update issue for vendors

  7. WCFM 6.7.18

    • Updated – 28/05/2025
    • Fixed – DataTables warning: table id=wcfm-* – invalid JSON response issue fixed

  8. WCFM 6.7.17

    • Updated – 26/05/2025
    • Enhance – WooCommerce 9.8+ compatibility check added
    • Fixed – Add ‘wcfm_allow_setup_page_access’ filter and nonce check to fix missing authorization vulnerability in setup page (reported by Brian Sans-Souci (liardom) – Wordfence)

  9. WCFM 6.7.16

    • Updated – 09/03/2025
    • Enhance – WooCommerce 9.7+ compatibility check added
    • Fixed – Stripe vendor connect issue for cross border countries. Now vendor needs to choose from a list of supported countries.
    • Fixed – Minor bug fixes

  10. WCFM 6.7.15

    • Updated – 12/01/2025
    • Enhance – WordPress 6.7+ compatibility check added
    • Enhance – WooCommerce 9.5+ compatibility check added

202410 releases

  1. WCFM 6.7.14

    • Updated – 02/10/2024
    • Fixed – Stripe Connect Issue for vendors where platform country is CANADA

  2. WCFM 6.7.13

    • Updated – 23/09/2024
    • Enhanced – Stripe Split Payment connect settings now use the store location address as prefilled data.
    • Fixed – Vulnerability in the Customer Manage Section: An unauthorized user can change a customer’s email, as reported by Wesley (Wcraft). Credit goes to Wesley for identifying this issue.
    • Fixed – Stripe Split Payment Issue with Cross-Border Payments: If the platform account and connected account(s) are not from the same country, Stripe payments fail when using “direct charge” mode.
    • Fixed – Issue related to report section Out of stock database query
    • Fixed – Minor typo fix, language pot file updated

  3. WCFM 6.7.12

    • Updated – 23/06/2024
    • Fixed – PHP Notice: Function ID was called incorrectly. Order properties should not be accessed directly.
    • Fixed – Replaced strlen() with mb_strlen() to support UTF-8 characters for menu labels in store-manager dashboard.
    • Enhanced – wcfm_get_customers_orders_stat() function to accurately calculate the total amount spent by vendors. This update resolves previous inaccuracies in displaying vendor-specific order statistics.

  4. WCFM 6.7.11

    • Updated – 07/06/2024
    • Enhanced – WordPress 6.5+ compatibility added
    • Enhanced – WooCommerce 8.9+ compatibility added

  5. WCFM 6.7.10

    • Updated – 23/03/2024
    • Enhanced – WooCommerce 8.7+ compatibility added
    • Fixed – Menu Manager Label changed after settings update

  6. WCFM 6.7.9

    • Updated – 10/03/2024
    • Fixed – Vulnerablity to Cross Site Scripting (XSS) issue fixed
    • Fixed – WooCommerce Checkout page stuck when using Stripe Split Pay
    • Fixed – Minor bug fixes

  7. WCFM 6.7.8

    • Updated – 20/02/2024
    • Enhanced – WooCommerce 8.6+ compatibility added
    • Enhanced – jQuery select2 library updated to version 4.0.13
    • Fixed – Order details page error when using WooCommerce 8.6.0+
    • Fixed – Product manage page attribute Select All/None issue
    • Fixed – Bulk action select all checkbox issue for Enquiry, Message, Withdrawal

  8. WCFM 6.7.7

    • Updated – 11/01/2024
    • Fixed – Resolve fatal error in vendor dashboard payment settings due to missing admin stripe credentials

  9. WCFM 6.7.6

  10. WCFM 6.7.5

20238 releases

  1. WCFM 6.7.4

  2. WCFM 6.7.3

  3. WCFM 6.7.2

  4. WCFM 6.7.1

  5. WCFM 6.7.0

  6. WCFM 6.6.9

  7. WCFM 6.6.8

  8. WCFM 6.6.7

20225 releases

  1. WCFM 6.6.6

  2. WCFM 6.6.5

  3. WCFM 6.6.4

  4. WCFM 6.6.3

  5. WCFM 6.6.2

202111 releases

  1. WCFM 6.6.1

  2. WCFM 6.6.0

  3. WCFM 6.5.14

  4. WCFM 6.5.13

  5. WCFM 6.5.12

  6. WCFM 6.5.11

  7. WCFM 6.5.10

  8. WCFM 6.5.9

  9. WCFM 6.5.8

  10. WCFM 6.5.7

  11. WCFM 6.5.6

202019 releases

  1. WCFM 6.5.5

  2. WCFM 6.5.4

  3. WCFM 6.5.3

  4. WCFM 6.5.2

  5. WCFM 6.5.1

  6. WCFM 6.5.0

  7. WCFM 6.4.9

  8. WCFM 6.4.8

  9. WCFM 6.4.7

  10. WCFM 6.4.6

  11. WCFM 6.4.5

  12. WCFM 6.4.4

  13. WCFM 6.4.3

  14. WCFM 6.4.2

  15. WCFM 6.4.1

  16. WCFM 6.4.0

  17. WCFM 6.3.8

  18. WCFM 6.3.7

  19. WCFM 6.3.6

201945 releases

  1. WCFM 6.3.5

  2. WCFM 6.3.4

  3. WCFM 6.3.3

  4. WCFM 6.3.2

  5. WCFM 6.3.1

  6. WCFM 6.3.0

  7. WCFM 6.2.10

  8. WCFM 6.2.9

  9. WCFM 6.2.8

  10. WCFM 6.2.7

  11. WCFM 6.2.6

  12. WCFM 6.2.5

  13. WCFM 6.2.4

  14. WCFM 6.2.3

  15. WCFM 6.2.2

  16. WCFM 6.2.1

  17. WCFM 6.2.0

  18. WCFM 6.1.6

  19. WCFM 6.1.5

  20. WCFM 6.1.4

  21. WCFM 6.1.3

  22. WCFM 6.1.2

  23. WCFM 6.1.1

  24. WCFM 6.1.0

  25. WCFM 6.0.5

  26. WCFM 6.0.4

  27. WCFM 6.0.3

  28. WCFM 6.0.2

  29. WCFM 6.0.1

  30. WCFM 6.0.0

  31. WCFM 5.4.7

  32. WCFM 5.4.6

  33. WCFM 5.4.5

  34. WCFM 5.4.4

  35. WCFM 5.4.3

  36. WCFM 5.4.2

  37. WCFM 5.4.1

  38. WCFM 5.4.0

  39. WCFM 5.3.3

  40. WCFM 5.3.2

  41. WCFM 5.3.1

  42. WCFM 5.3.0

  43. WCFM 5.2.9

  44. WCFM 5.2.8

  45. WCFM 5.2.7

201875 releases

  1. WCFM 5.2.6

  2. WCFM 5.2.5

  3. WCFM 5.2.4

  4. WCFM 5.2.3

  5. WCFM 5.2.2

  6. WCFM 5.2.1

  7. WCFM 5.2.0

  8. WCFM 5.1.11

  9. WCFM 5.1.10

  10. WCFM 5.1.9

  11. WCFM 5.1.8

  12. WCFM 5.1.7

  13. WCFM 5.1.6

  14. WCFM 5.1.5

  15. WCFM 5.1.4

  16. WCFM 5.1.3

  17. WCFM 5.1.2

  18. WCFM 5.1.1

  19. WCFM 5.1.0

  20. WCFM 5.0.10

  21. WCFM 5.0.9

  22. WCFM 5.0.8

  23. WCFM 5.0.7

  24. WCFM 5.0.6

  25. WCFM 5.0.5

  26. WCFM 5.0.4

  27. WCFM 5.0.3

  28. WCFM 5.0.2

  29. WCFM 5.0.1

  30. WCFM 5.0.0

  31. WCFM 4.2.4

  32. WCFM 4.2.3

  33. WCFM 4.2.2

  34. WCFM 4.2.1

  35. WCFM 4.2.0

  36. WCFM 4.1.9

  37. WCFM 4.1.8

  38. WCFM 4.1.7

  39. WCFM 4.1.6

  40. WCFM 4.1.5

  41. WCFM 4.1.4

  42. WCFM 4.1.3

  43. WCFM 4.1.2

  44. WCFM 4.1.1

  45. WCFM 4.1.0

  46. WCFM 4.0.10

  47. WCFM 4.0.9

  48. WCFM 4.0.8

  49. WCFM 4.0.7

  50. WCFM 4.0.6

  51. WCFM 4.0.5

  52. WCFM 4.0.4

  53. WCFM 4.0.3

  54. WCFM 4.0.2

  55. WCFM 4.0.1

  56. WCFM 4.0.0

  57. WCFM 3.5.10

  58. WCFM 3.5.9

  59. WCFM 3.5.8

  60. WCFM 3.5.7

  61. WCFM 3.5.6

  62. WCFM 3.5.5

  63. WCFM 3.5.4

  64. WCFM 3.5.3

  65. WCFM 3.5.2

  66. WCFM 3.5.1

  67. WCFM 3.5.0

  68. WCFM 3.4.7

  69. WCFM 3.4.6

  70. WCFM 3.4.5

  71. WCFM 3.4.4

  72. WCFM 3.4.3

  73. WCFM 3.4.2

  74. WCFM 3.4.1

  75. WCFM 3.4.0

201787 releases

  1. WCFM 3.3.8

  2. WCFM 3.3.7

  3. WCFM 3.3.6

  4. WCFM 3.3.5

  5. WCFM 3.3.4

  6. WCFM 3.3.3

  7. WCFM 3.3.2

  8. WCFM 3.3.1

  9. WCFM 3.3.0

  10. WCFM 3.2.9

  11. WCFM 3.2.8

  12. WCFM 3.2.7

  13. WCFM 3.2.6

  14. WCFM 3.2.5

  15. WCFM 3.2.4

  16. WCFM 3.2.3

  17. WCFM 3.2.2

  18. WCFM 3.2.1

  19. WCFM 3.2.0

  20. WCFM 3.1.7

  21. WCFM 3.1.6

  22. WCFM 3.1.5

  23. WCFM 3.1.4

  24. WCFM 3.1.3

  25. WCFM 3.1.2

  26. WCFM 3.1.1

  27. WCFM 3.1.0

  28. WCFM 3.0.5

  29. WCFM 3.0.4

  30. WCFM 3.0.3

  31. WCFM 3.0.2

  32. WCFM 3.0.1

  33. WCFM 3.0.0

  34. WCFM 2.6.2

  35. WCFM 2.6.1

  36. WCFM 2.6.0

  37. WCFM 2.5.2

  38. WCFM 2.5.1

  39. WCFM 2.5.0

  40. WCFM 2.4.6

  41. WCFM 2.4.5

  42. WCFM 2.4.4

  43. WCFM 2.4.3

  44. WCFM 2.4.2

  45. WCFM 2.4.1

  46. WCFM 2.4.0

  47. WCFM 2.3.9

  48. WCFM 2.3.8

  49. WCFM 2.3.7

  50. WCFM 2.3.6

  51. WCFM 2.3.5

  52. WCFM 2.3.4

  53. WCFM 2.3.3

  54. WCFM 2.3.2

  55. WCFM 2.3.1

  56. WCFM 2.3.0

  57. WCFM 2.2.6

  58. WCFM 2.2.5

  59. WCFM 2.2.4

  60. WCFM 2.2.3

  61. WCFM 2.2.2

  62. WCFM 2.2.1

  63. WCFM 2.2.0

  64. WCFM 2.1.2

  65. WCFM 2.1.1

  66. WCFM 2.1.0

  67. WCFM 2.0.5

  68. WCFM 2.0.4

  69. WCFM 2.0.3

  70. WCFM 2.0.2

  71. WCFM 2.0.1

  72. WCFM 2.0.0

  73. WCFM 1.1.6

  74. WCFM 1.1.5

  75. WCFM 1.1.4

  76. WCFM 1.1.3

  77. WCFM 1.1.2

  78. WCFM 1.1.1

  79. WCFM 1.1.0

  80. WCFM 1.0.7

  81. WCFM 1.0.6

  82. WCFM 1.0.5

  83. WCFM 1.0.4

  84. WCFM 1.0.3

  85. WCFM 1.0.2

  86. WCFM 1.0.1

  87. WCFM 1.0.0

Questions about WCFM’s releases

What is the latest version of WCFM?

6.8.2, released on Nov 2, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.

How often is WCFM updated?

10 releases in the last year, about one every 39 days. Its first release on WordPress.org dates from March 2017.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in WCFM’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.