What We’re Building for You
1.4.0
Changed – The Zaplane-operated MCP server has been removed. Zaplane now registers its abilities with the WordPress Abilities API; a core-hosted MCP adapter the site owner installs is what exposes them to an AI client. Authentication and transport are WordPress core’s responsibility.
Changed – Minimum WordPress is 6.8.
Removed – The “Custom PHP Code” step (custom-code-execution) is no longer bundled with the WordPress.org distribution.
Security – IntegrationBase::verify_webhook_signature() now denies by default. Integrations that opt into webhooks must override it with their provider’s HMAC/token check.
Security – The determine_current_user filter for remote-watch pairings now matches the /zaplane/v1/remote/run route exactly and only on POST, so a probe on another URL that contains the substring can no longer trip the filter.
Security – The ability loader no longer sets meta.public = true; abilities remain gated on current_user_can( ‘manage_options’ ) through their permission_callback.
Security – The OpenAI-compatible AI test-connection call is now routed through HttpGuard so a user-supplied base URL cannot be used to probe internal hosts.
Fixed – Fixed live dynamic selectors so new workflow nodes prefetch their site data immediately instead of depending on a dropdown-open event; failed lookups now settle safely instead of retrying continuously.
Fixed – Fixed the Email Templates create button shrinking and wrapping at desktop, tablet, and responsive breakpoints.
Fixed – Restored the Custom Apps and Business Knowledge screens instead of showing a disabled-feature placeholder, and enabled both modules by default.
Fixed – Kept the shared Zaplane header on one row at tablet/mobile widths and compacted secondary header controls on smaller screens.
Fixed – Fixed the workflow editor header spacing and Status control clipping; secondary workflow actions now move into the 3-dot menu on narrower screens so Status and Update remain visible.
Fixed – Fixed Connections and Folders mobile headers so the title and primary action stay on one compact row.
Fixed – Fixed Business Knowledge mobile responsiveness: primary action stays visible, secondary actions move into the 3-dot menu, filters fit without clipping, and search uses the full row.
Fixed – Removed the extra WordPress admin-bar-sized blank strip above the workflow editor header at desktop and responsive widths.
Fixed – Reworked the workflow canvas controls into compact, aligned floating tool groups with consistent button sizing, spacing, borders, hover states, and mobile positioning.
Fixed – Resolved the duplicate handle_incoming() method that caused a PHP critical error.
Fixed – Fixed the dashboard login/reload flow so it loads normally again.
Fixed – Corrected the Log History horizontal scrollbar and responsive layout issues.
Fixed – Fixed the shared modal/overflow behavior so opening Create Workflow no longer causes the right-side scrollbar to disappear or the UI to shift across Zaplane tabs.
Fixed – Fixed the Dashboard recent workflow data rendering, empty-state messaging and heading output.
Fixed – Improved Log History UX with responsive table behavior, accessibility labels and consistent duration text formatting.
Fixed – Cleaned up workflow UI issues including unused code, missing labels, keyboard access and related lint-level problems.
Fixed – Reduced the react-datepicker build warning by switching to a stable CommonJS entry.
Fixed – Rebuilt the production frontend assets successfully and verified the build remains healthy.
Fixed – Fixed the Import button icon issue in the workflow UI.
Fixed – Fixed pagination issues across the Zaplane admin interface.
Fixed – Fixed Mailchimp trigger and action issues for more reliable workflow execution.
Fixed – Fixed Custom App REST API issues affecting REST API requests and responses.
Fixed – Fixed FunnelKit trigger and action issues.
Fixed – Fixed SureMark trigger and action issues.
Changed – Updated the shared modal and drawer overflow handling to preserve layout stability when a panel opens.
Changed – Improved the overall admin UI consistency for logs and recent-run views across narrower screens.
Changed – Normalized project lint configuration and cleaned up repeated styling issues to keep the release baseline healthy.
Added – Added Easy Content Manager (ECM) integration with 28 triggers and 34 actions.
Added – Added ECM item, custom-field, user, and taxonomy-term triggers and actions, plus triggers and actions for the Frontend Submission, Review & Ratings, Claim, Bookmark, Upvote, and Reactions addons.
Added – Added dynamic ECM selectors for post types, taxonomies, post-field keys, and user-field keys.
Added – Added ZenCommunity Core + Pro integration with 32 triggers and 34 actions.
Added – Added automation support for community members, profiles, spaces, posts, comments, reactions, polls, and events.
Added – Added ZenCommunity Pro support for private messaging, group messaging, and support ticket workflows.
Added – Added dynamic field selectors for spaces, users, roles, events, posts, and ticket settings.
Added – Added cURL support to Custom Apps, allowing users to create Custom App requests directly from cURL configurations.
Added – Added a new GemBooking integration with trigger and action support.
Added – Added new Telegram triggers and actions for Telegram-based workflow automation.
Improved – Improved permission handling for member-triggered, admin-owned workflows.
Improved – Improved action error handling to stop downstream steps when an action fails.
Improved – Improved compatibility with background workflow execution.
Fixed – Fixed live dynamic selectors so new workflow nodes prefetch their site data immediately instead of depending on a dropdown-open event; failed lookups now settle safely instead of retrying continuously.
Fixed – Fixed trigger detection and payload handling across supported ZenCommunity events.
Fixed – Fixed action failure states being incorrectly treated as successful workflow runs.
Fixed – Fixed sender identity handling in automated messaging.
Testing – Validated all 32 triggers and 34 actions, including destructive operations using database transactions and rollbacks to preserve test data.
Oct 7, 2026
Oct 7, 2026
1.3.1
Removed – Switch Theme action. Changing the active theme is the site owner’s decision, taken in the Appearance screens. The Theme Switch trigger stays: a workflow can still react to a switch the owner makes.
Removed – Authenticate User action. It called wp_signon() with credentials stored in the workflow, which set auth cookies on whatever request happened to be running the run — a visitor’s page view could end up signed in as that account.
Security – Create, Update and Delete User accept only the fields their own form offers, filtered and sanitized per field, and only a role the site actually defines. Delete refuses the last remaining administrator and the account the run is using.
Security – The incoming-webhook and Catch Webhook routes verify the provider’s signature or the trigger’s shared secret in their permission_callback, so an unsigned request never reaches the code that dispatches a workflow.
Security – The ORM refuses any table, column, operator, sort direction, join type or aggregate that is not a plain identifier or a known keyword (Identifier), and prepares every value in the same call that runs the statement.
Security – Schema changes and the remaining direct reads pass table names as %i identifiers to $wpdb->prepare().
Security – The admin colour palette is validated before it becomes CSS, the integrations catalogue is escaped before it is inlined in a
Changed – LifterLMS, GamiPress and Paid Memberships Pro option lists are read through get_posts()/prepare() rather than the posts table directly.
Changed – README documents the Telegram API address and the links the MCP screen offers to claude.ai and ChatGPT.
Fixed – Fixed live dynamic selectors so new workflow nodes prefetch their site data immediately instead of depending on a dropdown-open event; failed lookups now settle safely instead of retrying continuously.
Fixed – select(), addSelect() and groupBy() accept an array of columns again; passing one nested the array and produced SELECT \Array`, which broke pluck()andvalue()`.
Sep 20, 2026
Sep 20, 2026
1.3.0
Added – AI steps use the WordPress AI Client by default. On WordPress 7.0 and later, the AI, AI Agent, and Generate Image steps use the provider configured by the site owner in WordPress, without storing an API key in Zaplane. The AI Agent’s tool calling also runs through this client. OpenAI, Anthropic, Gemini, and OpenAI-compatible API keys remain available for older WordPress versions, audio transcription, and knowledge-base embeddings.
Added – Hosted AI connectors can sign in to the MCP server. Claude.ai and ChatGPT connect through OAuth 2.1 using dynamic client registration or a client ID metadata document. An administrator approves each connection through a consent screen. WordPress application passwords are also supported, with access limited to read and write operations.
Added – MCP: Every tool call is recorded on the Logs screen. Email notifications are sent the first time a token runs a workflow and when a token is repeatedly refused. Tokens can expire, and run tokens can be restricted to selected workflows.
Added – MCP: Users without administrator privileges can request to connect an AI client, subject to administrator approval. The issued token operates with the permissions of the requesting user.
Added – MCP: Settings → AI access includes a self-check for diagnosing connection issues and can generate the configuration file for the selected AI client.
Added – MCP: list_field_options provides AI clients with the site’s available field options, including courses, products, forms, and CRM lists, preventing them from guessing IDs.
Added – A workflow can start from multiple triggers. Add additional triggers beneath the first trigger on the canvas. Whichever trigger fires starts a workflow run from itself and follows only its own connections. Triggers are numbered on the canvas, the Logs screen identifies which trigger started each run, and a trigger can be deleted as long as at least one remains.
Added – {{trigger.*}} provides access to the data from whichever trigger starts a workflow run. The variables {{workflow.trigger_app}}, {{workflow.trigger_event}}, and {{workflow.trigger_node_id}} identify the triggering app, event, and node, allowing a Router to branch based on the trigger.
Added – Match fields to another trigger. A trigger can map its data to another trigger’s field names, allowing steps that use variables such as {{1.email}} to receive values when a different trigger fires. Fields with matching names can be mapped in a single click.
Added – Warnings for workflows with multiple triggers. The editor identifies triggers without an app, disconnected triggers, duplicate triggers that could run twice, steps referencing fields unavailable from another trigger, and webhooks without a secret that share steps with a site trigger. Warnings appear on the canvas without preventing the workflow from being saved.
Added – Each Catch Webhook trigger has its own URL: /hook//. The existing /hook/ URL remains supported and routes requests to the first webhook trigger.
Added – Test Trigger listens only for the selected trigger. Test Flow Once listens for all triggers and runs from whichever one fires first.
Added – MCP: run_workflow and test_workflow now accept trigger_node_id, and dry runs process one trigger at a time.
Added – Connecting steps is easier. Connect steps by dropping a line anywhere on a step’s card instead of targeting only the small connection dot. The dots have larger grab areas, and lines snap to nearby connection points. While dragging, compatible steps are outlined. Releasing a line on an empty canvas opens the step picker with the connection already established. Connections into triggers, loops, and duplicate lines are rejected.
Added – Group recipes. A single recipe can configure multiple workflows at once. Run Group Recipe opens a setup screen where users can enable or disable workflows and individual steps, configure values such as coupon discounts, select required connections, and create all workflows together in a new folder as drafts or active workflows. The first available group recipe is WooCommerce Customer Lifecycle, which includes abandoned-cart recovery, a thank-you coupon, a feedback request, a win-back email, and a birthday coupon.
Added – Register a recipe with an array. Define each step using its app and event, such as gemcrm.send_email, along with its settings. Zaplane automatically arranges the steps, connects them, and assigns labels, icons, and trigger hooks. Register recipes using zaplane_register_recipe() or the zaplane_register_recipes action. See docs/recipes/registering-recipes.md for details. Recipes registered by plugins appear the next time the Recipes page is opened.
Added – Every recipe gets a setup screen. Selecting Use Recipe opens the same setup interface used by group recipes, displaying only the settings, optional steps, connections, and workflow name required by that recipe.
Added – Folders created from group recipes identify the recipe they came from. Users can activate or pause all workflows within a folder at once.
Added – The Recipes page can be filtered to show only group recipes or only single-workflow recipes.
Added – StoreEngine Store Emails. A new group recipe manages StoreEngine store emails through workflows, including order confirmations, status updates, order notes, refunds, shipping, delivery, cancellations, failed-payment recovery, failed-renewal recovery, subscription renewal and cancellation emails, new-order and failed-payment alerts, and post-delivery review requests. Each email is managed by an individual workflow that users can customize. Some workflows include a follow-up coupon or order note. When a workflow is active, the corresponding StoreEngine email is disabled; pausing the workflow restores StoreEngine’s email delivery. This feature requires a StoreEngine version that supports the storeengine/email/setting filter.
Added – StoreEngine: A Subscription Renewal Payment Failed trigger is available with a link for retrying payment. Order triggers now provide first_name, order_date, total_formatted, items_summary, payment_method_title, order_url, payment_url, and edit_order_url. Status triggers provide status labels, Order Item Shipped provides the item name, courier, and tracking information, refund triggers provide the amount and reason, and subscription triggers provide the customer’s name and formatted total.
Added – StoreEngine’s Create Coupon step can append a random suffix to coupon codes, preventing codes generated from order numbers from being easily guessed.
Added – Built-in Zaplane recipes no longer reference workflow steps by number. Their emails and steps use {{trigger.first_name}} to access trigger data and named variables such as {{coupon.code}} to reference the output of a previous step. Existing workflows created from recipes continue to work without changes.
Changed – Updates now come exclusively from WordPress.org. The bundled licensing SDK has been removed. It previously checked store.kodezen.com for updates, retrieved promotions, and could transmit usage data even after the user declined the opt-in.
Changed – Action Scheduler has been updated to version 4.1.0. WordPress 6.8 or later is now required, replacing the previous minimum requirement of WordPress 6.0.
Changed – The Zaplane admin menu no longer requests a position near the top of the WordPress admin menu.
Changed – The uncompiled source code of the admin application is now included with the plugin. Every compiled file identifies its corresponding source file.
Security – Merge tags are now parsed instead of being compiled into PHP and executed with eval(). Previously, a webhook body could potentially reach a function call through this process.
Security – URLs originating from workflow settings or run data are validated on every redirect. Private and reserved network addresses are rejected.
Security – MCP tokens now operate as the users to whom they were issued, and those users must have the manage_options capability for every request. Previously, a token could retain administrator-level access even if its associated user was subsequently demoted or deleted.
Fixed – Live dynamic selectors now prefetch site data immediately when new workflow nodes are added instead of waiting for a dropdown-open event. Failed lookups also settle safely without continuous retries.
Fixed – GemCRM’s Send Email to a Contact action could target the wrong contact, while Send Email to a List could email every contact. Both actions now send only to the selected recipients and skip unsubscribed or bounced contacts.
Fixed – The admin menu icon no longer renders as a grey smudge under most WordPress admin colour schemes.
Fixed – MCP batch requests no longer return an extra response, and rate-limit errors now return HTTP 429 instead of HTTP 401.
Fixed – Workflows created from the built-in WooCommerce and GemCRM recipes could not be activated because their Send Email steps lacked the Email Content setting. Existing recipes on a site are corrected during the plugin update.
Fixed – Renaming a built-in recipe no longer creates a duplicate during the next update, and deleting a built-in recipe no longer causes it to reappear. Built-in recipes are now identified by their slugs, and deleted recipes remain deleted.
Fixed – The Recipes page now displays more than the first 20 recipes.
Fixed – Fields containing hyphens, such as the Contact Form 7 field your-email, now resolve correctly. Previously, a Create Contact step could report that a valid email address was required because the field value was not retrieved. Subtraction between two values continues to work as expected.
Fixed – Form submissions no longer return errors when two or more triggers, within the same workflow or across different workflows, listen for the same form. All matching workflows can start without causing an error for the visitor.
Fixed – Changes to a live trigger’s settings now take effect without waiting up to an hour, even when no workflow steps are added or removed. The trigger cache now uses the saved workflow graph rather than relying only on the version.
Fixed – Variables using {{wp.…}} or {{workflow.…}} alongside step outputs no longer resolve to the wrong step when merging data causes step IDs to be renumbered.
Fixed – The Logs Re-Try button now reruns the workflow from the same trigger using the original run data, rather than retrying an unrelated node run that shares the same run ID.
Fixed – Scheduled and inactive-customer triggers now maintain separate last-fired records. Previously, each workflow shared a single record across these triggers, allowing one trigger to prevent another from firing as expected.
Fixed – Test Trigger and Test Flow Once no longer execute captured events twice—once as a real event and once as a test. Test events also no longer block real events while waiting for a test to complete. Captured events now execute only as tests when running in test mode.
Sep 15, 2026
Sep 15, 2026
1.2.0
Added: aBlocks integration with a new Form Submitted trigger.
Added: 21 new FluentCart triggers and 52 new FluentCart actions covering carts, coupons, licences, customers, orders, products, and subscriptions.
Added: optional MCP server support for Claude, Cursor, and other Model Context Protocol clients.
Added: scoped and revocable tokens for MCP access.
Added: opt-in modules for new installations while preserving existing module settings.
Added: module status cards to the Workflows, Dashboard, and Connections screens.
Improved: the workflow builder with clearer trigger, action, tool, and AI node types.
Improved: workflow canvas connectors and keyboard-accessible node controls.
Rebuilt: the dark theme for improved readability and accessibility.
Updated: dashboard charts to follow the selected color palette.
Reduced: the admin bundle size from 23.8 MB to 1.6 MB.
Removed: the Dokan “Withdraw Request Pending” trigger.
Removed: the FluentCart “Order Paid Done” trigger.
Existing workflows using removed triggers must have their trigger selected again.
Sep 8, 2026
Sep 8, 2026
1.1.0
Added: StoreEngine integration with order, subscription, and product triggers and actions.
Added: AI Chat Model support for Anthropic, OpenAI, and WordPress Core AI.
Added: AI Agent with Chat Model, Memory, Tools sub-nodes, and MCP server support.
Added: Conversation Memory for persistent AI conversation history.
Added: Business Knowledge with StoreEngine product synchronization.
Added: Custom Apps for REST API and same-site WordPress hook integrations.
Added: bidirectional Webhook support with Catch Webhook and Send Webhook actions.
Added: optional HMAC-SHA256 webhook signing.
Added: Messenger and WhatsApp AI auto-reply workflows.
Added: Academy integration with course enrollment triggers, actions, and access-group membership.
Added: Manual Trigger, Schedule Trigger, and Human-in-the-Loop approval.
Added: Router, Repeater/Iterator, Condition, and Filter workflow controls.
Added: CSV, XML, JSON Parser, Formatter, Date/Time, Image Helper, Set Variable, and Sticky Note tools.
Added: the “AI Reply to Incoming Webhook” recipe.
Improved: dynamic data token selection with the @ token picker and sample outputs.
Improved: Business Knowledge, field, checkbox, and connection interfaces.
Improved: workflow node ports, branch handles, and AI Agent sub-node handles.
Fixed: AI and AI Agent incorrectly appearing as trigger options.
Fixed: Custom Apps trigger handling, labels, and app picker issues.
Improved: Webhook Body handling for multiline and quoted values.
Fixed: several node port, multiple-output, route indicator, CSV parser, and dynamic data resolution issues.
Jul 14, 2026
Jul 14, 2026
1.0.2
Improved: plugin stability.
Fixed: various bugs and issues.
Jun 25, 2026
Jun 25, 2026
1.0.0
Initial release of Zaplane.
Added: the visual workflow builder.
Added: trigger and action based automation.
Added: support for multi-step WordPress workflows.
Jun 14, 2026
Jun 14, 2026