v1.6.0 Latest
May 25, 2026
New 4 Improve 3 Fix 11 Security 2 Dev 3
New
- Buy ad credits directly with Stripe or PayPal. Advertisers can top up their credit balance using a card or PayPal account without going through a WooCommerce / EDD / PMPro checkout. The hosted-checkout flow is server-authoritative and resilient to gateway retries, so a single click can't be charged twice.
- Weekly performance report. Admins now receive an opt-in weekly email summarising impressions, clicks, CTR, and top-performing placements across the whole site. Useful for monitoring trends without opening the dashboard every day.
- Target ads by user role and BuddyPress member type. The ad-targeting module now respects both standard WordPress roles and BuddyPress member types, so you can show different creatives to "Gold members" vs "Editors" without writing any code.
- "Visitors Reached" metric on the analytics dashboard. The previous Unique Visitors counter was harder to interpret at a glance; the new Visitors Reached tile is end-user-focused and clearly labelled.
Improve
- Membership lifecycle emails (subscribe, switch, cancel, reactivate, payment-failed, and 3 more) are now stored as theme-overridable template files instead of being hard-coded in PHP. Sites can customise the markup without forking the plugin.
- The `[wbam_submit_ad]` shortcode markup is now a theme-overridable template, so custom submission forms no longer require child-class extensions.
- Replaced a confirm-dialog implementation with the shared accessible modal used elsewhere in the plugin - keyboard users no longer hit a native browser confirm.
Fix
- "Unique Visitors" was being inflated on busy campaigns. The number now reflects actual unique visitors instead of double-counting some events.
- The "Performance Over Time" chart on the analytics dashboard now actually loads. Previously the chart could come up blank or showing zero on every day.
- The "Top Placements" widget was reading from the wrong analytics table on some installs, so the list could be empty or out-of-date. It now uses the same data source as the rest of the dashboard.
- The Device Breakdown chart now reflects real traffic instead of all-Unknown. (This release wires Pro to consume the device-type signal that the free plugin started recording in 2.8.1.)
- Editing a "Rich Content" ad from the backend no longer reverts the ad type back to the default on save. A one-time migration also normalises any ads that had been stored with the old "rich" type slug.
- Re-running the setup wizard no longer creates a duplicate advertiser record for the site owner. The wizard now detects an existing advertiser profile and reuses it.
- The "Switch Plan" confirmation modal now shows the real prorated amount you will be charged or credited, instead of the new plan's full price. (The actual charge was always prorated correctly - only the modal was wrong.)
- The active-listings count and the categories count on the classifieds admin screen no longer disagree. Both numbers now use the same query.
- Confirmation dialogs on the advertiser dashboard now appear consistently - previously some confirm prompts could silently no-op on certain themes.
- Closed 6 QA-rejected bugs in the campaign list, analytics filtering, and campaign override flows. Closed 2 QA-rejected bugs in the advertiser portal.
- 9 previously-shipped customer fixes were re-browser-verified during the 1.6.0 audit pass - every one is now covered by an automated upgrade-path test (Free → Pro), so they won't silently regress in a future release.
Security
- 6 REST endpoints that previously read `__return_true` for their permission check now use an explicit `REST_Permissions::public_read` gate so the intent is auditable. No behaviour change for legitimate clients.
- Bundled Wbcom Credits SDK bumped to v1.3.0. Adds a server-authoritative pricing resolver so the direct-pay checkout endpoint cannot accept client-supplied prices. This release introduces the first WBAM feature to use direct-pay (Stripe / PayPal Buy Credits), so the SDK upgrade ships in lockstep with the new gateway flow.
Dev
- 36 unused capability registrations removed from the database (Database schema 4.0.0). The plugin now registers only the capabilities it actually checks against.
- Manager classes (Custom_Field_Manager, Geolocation_Manager, Review_Manager, Package_Manager, Advertiser_Manager, Credits_Bridge, Billing_Manager) now return `WP_Error` objects on failure instead of `false`, so callers can surface the actual reason. The new `Manager_Interface` contract makes the pattern enforceable.
- Centralised advisory-lock helper now wraps every cron callback, so two overlapping cron runs can no longer corrupt analytics counters.