WP Manifestindependent plugin directory

Install

Download bricks-form-2-webhook.zip From the v1.2.11 release on GitHub, Jun 3, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/paveltajdus/bricks-form-2-webhook/releases/download/v1.2.11/bricks-form-2-webhook.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

WordPress plugin that sends Bricks Builder form submissions to any webhook URL using the WordPress "Custom" Form Action in Bricks.

✨ Features

  • Sends Bricks Builder form data to any webhook URL (e.g., Make.com, Zapier).
  • Supports multiple forms, each with its own webhook URL and custom success/error messages.
  • Simple admin interface under Settings > Bricks Form 2 Webhook to manage your webhooks.
  • Debug mode to help troubleshoot form submissions.
  • Automatic updates from GitHub.

🔧 Installation

  1. Download the latest bricks-form-2-webhook.zip from the GitHub Releases page.
  2. In your WordPress admin, go to Plugins > Add New > Upload Plugin.
  3. Upload the downloaded ZIP file and activate the plugin.
  4. Configure your webhooks under Settings > Bricks Form 2 Webhook.

⚙️ Configuration

  1. Get Form ID from Bricks:
    • In the Bricks editor, select your form element.
    • Find the CSS ID (e.g., bricks-element-fszxsr).
    • Copy the unique part of the ID (e.g., fszxsr). This is your Form ID.
  2. Add Webhook in Plugin Settings:
    • Go to Settings > Bricks Form 2 Webhook in your WordPress admin.
    • Enter the Form ID you copied.
    • Enter your Webhook URL.
    • Optionally, customize the Success Message and Error Message.
    • Click "Add Webhook".
  3. Configure Bricks Form Action:
    • In your Bricks form settings, go to Actions.
    • Add a new action and select Custom as the action type.
    • Save your Bricks form.

That's it! Your form submissions will now be sent to the configured webhook.

🆘 Troubleshooting

  • Data not sending?
    • Double-check that the Form ID in the plugin settings exactly matches the ID from your Bricks form (without the bricks-element- prefix).
    • Ensure the form action in Bricks is set to "Custom".
    • Enable Debug Mode in the plugin settings and check the log for errors after a test submission. The log can be found in the plugin's settings page or downloaded.
    • Verify your webhook URL is correct and publicly accessible.

📄 License

This plugin is licensed under GPL v2 or later.

🔄 Changelog

See the Releases page on GitHub for detailed changelogs.


Inspired by the excellent work of stingray82's webhooks-for-bricks-forms plugin.

Releases

14 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.11 latest
Jun 3, 2025 1 year ago
bricks-form-2-webhook.zip
12
Jun 3, 2025 1 year ago
bricks-form-2-webhook.zip
5
Jun 3, 2025 1 year ago
bricks-form-2-webhook.zip
4
Jun 3, 2025 1 year ago
bricks-form-2-webhook.zip
0
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.6.zip
3
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.5.zip
3
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.4.zip
3
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.3.zip
2
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.2.zip
0
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.1.zip
0
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.2.0.zip
0
Jun 3, 2025 1 year ago
bricks-form-2-webhook-v1.1.1-debug.zip
0
Jan 2, 2025 1 year ago
tag only
—
Jan 2, 2025 1 year ago
tag only
—
B grade

Security

Bricks Form 2 Webhook 1.2.11 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.2.11
Findings
2
Worst severity
medium
Content hash
b4896e6aadcaa589345cc45c…

Findings

  • medium Missing capability checks on webhook delete/debug log admin_init handlers

    missing_capability

    bf2w_handle_form_action and the admin_init delete/download/clear handlers only call wp_verify_nonce. The settings UI is behind manage_options, but admin_init handlers run for any authenticated user who can reach wp-admin with a valid nonce. Defense-in-depth failure: nonce alone is treated as authorization. Blast radius is webhook URL config and debug logs that may contain form PII in uploads/bf2w-debug.log.

    bricks-form-2-webhook.php:42-50,220-237,291-307,347-371

    Recommendation

    Add current_user_can('manage_options') (or equivalent) next to every nonce check before mutating bf2w_webhooks or reading/clearing the debug log.

  • low Debug log written under uploads may be web-accessible

    information_disclosure

    When debug mode is enabled, form payloads (including POST fallback) are appended to wp-content/uploads/bf2w-debug.log without an .htaccess deny rule. If the uploads directory is directly browsable, form submission data may leak.

    bricks-form-2-webhook.php:333-345

    Recommendation

    Store logs outside the web root or protect with deny rules; never log full POST bodies containing PII.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.