LoginSign Up
← Back to all sparks
F

Formidable Forms

MKT AUTO
Velocity6.3

Advanced WordPress form builder with calculations, views, and data-driven applications

formidableforms.com ↗

Formidable wired itself into WordPress's new agent-access standard, then spent August securing it.

wordpress-abilities-apimcpforms-apisignature-securityplugin-suite
◆Current state
Forms API 2.0 added support for the WordPress Abilities API and shipped an MCP adapter, opening Formidable's forms and entries to agent clients; the 2.0.1 patch made that adapter tolerate older MCP adapters bundled by other plugins like WooCommerce and Rank Math instead of refusing to load. Around that, the add-on suite is being hardened: signature forms gained form-level file protection, a role requirement for accessing signature files, and permanent deletion of old signatures on entry delete, following a Wordfence-reported validation gap fixed in 3.1. The core plugin's 6.34 extended entry search into repeater and embedded form data.
◆Where it's heading
Two threads run in parallel. One is exposure — Formidable is positioning form data as something an agent can read and write through a standard interface, and the compatibility patch shows it already collides with other plugins claiming the same surface. The other is containment — every recent add-on release tightens who can reach stored files and API keys, which is the natural counterweight when you have just opened a programmatic door into user-submitted data. Expect these to stay coupled: each new access path arrives with a permissions setting attached.
◆Prediction
The MCP adapter collision with WooCommerce and Rank Math points to a shared-adapter problem across the WordPress plugin ecosystem; expect Formidable to either defer to a canonical adapter or add capability negotiation rather than keep patching version checks.

◆Recent moves

  1. 8d ago

    Chart image security hardened, empty-data error fixed

    The Charts add-on hardens graph image handling and clears PHP 8 deprecations, plus fixes an error on empty data and untranslatable chart-block strings. Small, but it is the same containment pass the signature add-on has been getting.

    View source ↗
  2. 16d ago

    Formidable MCP server works alongside older adapters from other plugins

    The Formidable MCP server now runs alongside older MCP adapters shipped inside WooCommerce and Rank Math rather than showing an incompatibility message. It is a small patch with a large implication: multiple plugins are already competing to own the agent adapter in a single WordPress install.

    View source ↗
  3. 16d ago

    Signature files gain form-level protection and role-gated access

    Signature forms gain form-level file protection, a role requirement for accessing signature files, and permanent deletion of old signatures when an entry is removed. This is the containment half of the arc, arriving in the same window as the API work.

    View source ↗
  4. 21d ago

    Entry search reaches repeater and embedded form data

    Entry search now matches inside repeater and embedded form data, shortcode options are filtered to field types math calculations accept, and scale fields get before- and after-input settings. Core plugin work aimed at forms whose data is nested rather than flat.

    View source ↗
  5. 22d ago

    Forms API 2.0 adds WordPress Abilities API support and an MCP adapter

    ⚡ SPARK

    Forms API 2.0 is the release the rest of this window reacts to: it adds WordPress Abilities API support and an MCP adapter, alongside tighter API key scoping and constant-time key comparison. The 2.0.1 compatibility patch a week later shows how quickly that surface met other plugins.

    View source ↗
  6. 29d ago

    Signature deletion validation tightened after a Wordfence report

    Validation was tightened so only signature files, and only ones belonging to the active entry, can be deleted, credited to Wordfence. It set up the broader permissions model that 3.2 formalized two weeks later.

    View source ↗