2.9.2.4 - 2026-09-28
- Fix: Quantity 0 was sent to Amazon as a JSON string and dropped, leaving the listing oversellable (#77432)
- Fix: Quantity 0 was dropped a second time by filterEmptyFields() on PHP 7.4 (#77432)
- Fix: [meta_*] now also tries the underscore-prefixed meta key on the variation itself (#74607)
- Fix: The [meta_*] fallback could write an ACF field reference into a feed instead of the value (#74607)
2.9.2.3 - 2026-09-28
- Security: Feed and report detail views now require the Manage Amazon Listings capability
- Security: Throttle the external inventory report request endpoint
- Security: Escape Amazon-supplied values in feed and report detail views
- Security: Add nonce verification to the product type install and feed template conversion actions
- Security: Restrict object instantiation when reading the cached product type map
- Fix: Order Fulfillment feeds for orders that did not come from Amazon were created without an account and could never be submitted (#77274)
- Fix: Feed submission failures were silent - a failing submit left the feed pending with no error and no log entry (#77274)
- Fix: initAPI() can throw instead of returning false, which aborted the submit run for all remaining feeds (#77274)
- Fix: "No" in a boolean profile field (e.g. batteries required) was sent to Amazon verbatim instead of as false (#77274)
- Fix: Guard the two remaining null dereferences in the feed model (#77274)
- Fix: seems_utf8() deprecation notices on WordPress 7.0 and newer (#77433)
- Fix: Array to string conversion notice when a feed value is an array (#77433)
2.9.2.2 - 2026-09-11
- Security: fixes an authenticated SQL injection in the admin list tables. The orderby and order parameters were passed through to SQL without validation; all affected queries now use a strict column allow-list. Affects 2.9.2.1 and earlier. Update recommended for all installs.