Title: Zaplane – AI Agent Automation & Workflow Builder
Author: Kodezen LLC
Published: October 8, 2026
Last modified: October 15, 2026
---
Search plugins
# Zaplane – AI Agent Automation & Workflow Builder
By [Kodezen LLC](https://profiles.wordpress.org/kodezen/)
[Download](https://downloads.wordpress.org/plugin/zaplane.1.5.0.zip)
* [Details](https://kea.wordpress.org/plugins/zaplane/#description)
* [Reviews](https://kea.wordpress.org/plugins/zaplane/#reviews)
* [Installation](https://kea.wordpress.org/plugins/zaplane/#installation)
* [Development](https://kea.wordpress.org/plugins/zaplane/#developers)
[Support](https://wordpress.org/support/plugin/zaplane/)
## Description
**Zaplane** is a no-code **WordPress automation** plugin and workflow builder that
runs entirely inside your WordPress site. Connect a **trigger** (a WooCommerce order
placed, a form submitted, a user registered, a subscription renewed, a webhook received)
to one or more **actions** (send an email, add a contact to your CRM, post a Slack
message, create a Trello card, call an API) with delays, conditions, filters, loops
and AI steps in between.
Build **automation workflows** visually on a drag-and-drop canvas — no code required—
and let them run reliably in the background on Action Scheduler, the same queue
WooCommerce uses.
#### Why Zaplane?
* **No-code visual workflow builder** — design automations by connecting trigger
and action nodes on a flow canvas.
* **Self-hosted — no per-task fees** — workflows, run history and credentials stay
in your own WordPress database. No external automation service to pay per task
or per workflow. Data reaches a third-party only when a workflow or connection
you set up uses it (see External services).
* **100+ integrations** — WooCommerce, Easy Digital Downloads, FluentCRM, Mailchimp,
Slack, Discord, Telegram, WhatsApp, Gmail, Google Sheets, Zoom, LearnDash, Tutor
LMS, Elementor, Fluent Forms, Gravity Forms, WPForms, Contact Form 7 and many
more (full list below).
* **Flow control steps** — Delay, Condition, Filter, Router (multi-branch), Iterator(
loop), Set Variable, HTTP Request, Send/Catch Webhook, Human Approval, Schedule,
Manual trigger, Sticky Note.
* **Reliable background processing** — long-running and scheduled steps run on
Action Scheduler.
* **Ready-made recipes** — templates for abandoned carts, birthday messages, win-
backs, upsells, review requests, order confirmations, lead nurturing and more.
* **Optional AI automation** — write replies, run a tool-calling AI Agent, generate
images, or search your own knowledge base, through the WordPress AI Client (when
available in core) or your own OpenAI, Anthropic or Gemini key.
* **AI access through the WordPress Abilities API** — Zaplane registers its workflow
capabilities as abilities. Install an MCP adapter and an AI client you approve
can discover, build and run workflows. Zaplane runs no server of its own, and
every ability requires an administrator.
* **Build your own integrations** — Custom Apps let you add any REST API or WordPress
hook as a trigger or action without writing a plugin.
* **GPL-3.0, 100% free, no premium upsell** — every integration, trigger, action
and recipe is in this plugin.
#### What you can automate
* **WooCommerce automation** — welcome new customers, recover abandoned carts,
follow up on orders, tag high-value buyers in your CRM, notify Slack when a product
goes out of stock, send a review request after delivery, trigger subscription
renewal reminders.
* **CRM & marketing automation** — add form submissions to FluentCRM / Mailchimp/
Brevo / ActiveCampaign / Groundhogg / GemCRM, apply or remove tags, enrol contacts
in sequences, sync between CRMs, send birthday emails.
* **Form automation** — route Fluent Forms, Gravity Forms, WPForms, Contact Form
7, Formidable, Ninja Forms, Fillout, Typeform or Jotform submissions to any destination;
create tickets, cards, deals, posts, users or orders from a form.
* **LMS automation** — enrol learners on LearnDash, Tutor LMS, LifterLMS, MasterStudy
or Academy courses, grant membership on purchase, email instructors on course
completion, award points, print certificates.
* **Membership automation** — provision access on MemberPress, Paid Memberships
Pro, SureMembers, BuddyBoss or Ultimate Member when a payment succeeds; downgrade
on cancellation; sync membership status to a CRM.
* **Messaging automation** — post to Slack, Discord, Telegram or Microsoft Teams-
style channels, send Gmail / SureMail replies, auto-reply on WhatsApp or Facebook
Messenger, create Zoom or Google Meet meetings.
* **Content & publishing automation** — publish posts across sites, update ACF /
Meta Box / JetEngine fields, add Events Calendar events, generate PDFs, send
Google Docs / Google Sheets.
* **AI automation** — route a form submission through an AI Agent, summarise support
emails, auto-reply to webhooks with your knowledge base, translate content, extract
structured data.
* **Scheduled & recurring automation** — hourly, daily, weekly or cron-based jobs;
birthdays and anniversaries; polling triggers for Google Sheets / Google Docs;
delayed follow-ups.
#### Flow-control & utility steps
Delay (minutes, hours, days or until a date) · Condition (if/else) · Filter (stop
if criteria don’t match) · Router (branch into many paths) · Iterator / Repeater(
loop over a list) · Set Variable · Schedule · Manual trigger · Human Approval (pause
for a Slack approval) · HTTP Request · Catch Webhook · Send Webhook · Formatter ·
Date / Time · CSV · XML · JSON Parser · Image Helper · Conversation Memory · Business
Knowledge · MCP Client · Sticky Note.
#### Full integrations list
aBlocks, ActiveCampaign, Advanced Custom Fields (ACF), AI Agent (tool-calling),
AI Chat Model, Anthropic (Claude), AR Form, Avada Form, Beaver Builder, Bit Form,
Booking Calendar Contact Form, Brevo, BuddyBoss, Business Knowledge, Catch Webhook,
Contact Form 7, CoBlocks, Custom Apps, Discord, Divi Builder, Dokan, Easy Digital
Downloads, Elementor, Essential Blocks, Facebook Messenger, Fillout, FluentCart,
FluentCRM, FluentSMTP, Fluent Forms, Formidable Forms, FunnelKit, GameEngine, GamiPress,
GemBoards, GemBooking, GemCRM, Gmail, Google Docs, Google Gemini, Google Meet, Google
Sheets, Gravity Forms, Groundhogg, HTTP Request, JetEngine, Jotform, Kadence Blocks,
LearnDash, LifterLMS, Mailchimp, MasterStudy LMS, MemberPress, Meta Box, Metform,
MCP Client, Ninja Forms, OpenAI, OpenAI-compatible endpoints (Azure OpenAI, Ollama,
OpenRouter, self-hosted), Paid Memberships Pro, Paymattic, Profile Builder, QuizPress,
Send Webhook, Slack, Spectra, StoreEngine, SureCart, SureForms, SureMail, SureMembers,
Telegram, The Events Calendar, Trello, TruePlayer, Tutor LMS, Typeform, Ultimate
Member, weForms, WhatsApp, WooCommerce, WooCommerce Bookings, WordPress core (post
type, taxonomy, user, option, role, custom hook), WordPress AI Client, WP Map Block,
WPFunnels, WPForms, WP User Frontend, ZenAppBuilder, ZenCommunity, Zoom.
Each service needs your own account with that provider. See **External services**
below for exactly what Zaplane sends to each one, and when.
### External services
Zaplane contacts no external service when you install, activate or browse it, and
sends nothing to its authors. It talks to a third-party only after you add a connection
for it, and then only when you test that connection, when the editor loads options
from it, or when a step that uses it runs. Each service needs your own account;
review its terms and privacy before connecting. Requests carry your site’s address
in the User-Agent header.
The AI entries (Anthropic, Google Gemini, OpenAI, OpenAI-compatible, WordPress AI
Client) apply only when a connection uses that provider.
#### ActiveCampaign
* Sends: contact emails, names and phone numbers, and list / tag / automation IDs—
to your account’s API URL (e.g. `*.api-us1.com`) with your key, when you test
the connection or an ActiveCampaign step runs.
* Terms: https://www.activecampaign.com/legal/terms-of-service · Privacy: https://
www.activecampaign.com/legal/privacy-policy
#### Anthropic
* Sends: instructions, messages, conversation history, knowledge context, tool
definitions and results, and image URLs — to `api.anthropic.com` with your key,
when you test the connection or an AI / AI Agent step runs.
* Terms: https://www.anthropic.com/legal/commercial-terms · Privacy: https://www.
anthropic.com/legal/privacy
#### Brevo
* Sends: contact emails, names, attributes and list IDs — to `api.brevo.com` with
your key, when you test the connection or a Brevo step runs.
* Terms: https://www.brevo.com/legal/termsofuse/ · Privacy: https://www.brevo.com/
legal/privacypolicy/
#### Discord
* Sends: server, channel and user IDs and the message content you configure — to
Discord’s API with your bot token, when you test the connection, when the editor
loads channels, or when a Discord step runs.
* Terms: https://discord.com/terms · Privacy: https://discord.com/privacy
#### Fillout
* Sends: form IDs — to `api.fillout.com` with your key, when you test the connection
or the editor loads forms.
* Terms: https://www.fillout.com/terms · Privacy: https://www.fillout.com/privacy
#### Google Gemini
* Sends: prompts, conversation history, knowledge context and images; for semantic
search, knowledge titles / content and queries — to `generativelanguage.googleapis.
com` with your key, when an AI step runs or (with semantic search on) knowledge
is embedded or searched.
* Terms: https://ai.google.dev/gemini-api/terms · Privacy: https://policies.google.
com/privacy
#### Google (Gmail, Calendar, Meet)
* Sends: recipients, subjects and bodies; event titles, times, descriptions and
attendee emails; OAuth codes and tokens — to Google’s APIs (`gmail.googleapis.
com`, `www.googleapis.com`, `meet.googleapis.com`, with sign-in at `accounts.
google.com` / `oauth2.googleapis.com`) using the OAuth client you configure,
when you connect, when the editor loads labels or calendars, or when a Gmail /
Google Meet step runs.
* Terms: https://policies.google.com/terms (and https://developers.google.com/terms)·
Privacy: https://policies.google.com/privacy
#### Jotform
* Sends: form IDs and the form definitions you create — to `api.jotform.com` with
your key, when you test the connection, when the editor loads forms, or when
a Jotform step runs.
* Terms: https://www.jotform.com/terms/ · Privacy: https://www.jotform.com/privacy/
#### Mailchimp
* Sends: subscriber emails, merge fields, tags and audience IDs — to the `api.mailchimp.
com` data centre named in your key, when you test the connection or a Mailchimp
step runs.
* Terms: https://mailchimp.com/legal/terms/ · Privacy: https://www.intuit.com/privacy/
statement/
#### Meta (Messenger, WhatsApp)
* Sends: recipient ID or phone number, message text, templates, media URLs and
locations — to the Meta Graph API (`graph.facebook.com`) with your page or WhatsApp
Business token, when you test the connection or a Messenger / WhatsApp step runs.
* Terms: https://developers.facebook.com/terms/ and https://www.whatsapp.com/legal/
business-terms · Privacy: https://www.facebook.com/privacy/policy/
#### OpenAI
* Sends: instructions, messages, conversation history, knowledge context, tool
definitions and results, image URLs and prompts, audio files you point to; for
semantic search, knowledge text and queries — to `api.openai.com` with your key,
when you test the connection, when an AI step runs, or (with semantic search
on) when knowledge is embedded or searched.
* Terms: https://openai.com/policies/services-agreement/ · Privacy: https://openai.
com/policies/privacy-policy/
#### OpenAI-compatible providers
* Sends: the same data as the OpenAI entry — to the base URL you enter (e.g. OpenRouter
at `openrouter.ai`, Azure OpenAI, or a self-hosted endpoint such as Ollama),
when you test the connection, when the editor loads models, or when an AI / AI
Agent step runs.
* Terms and privacy: those of the provider you choose. OpenRouter: https://openrouter.
ai/terms · https://openrouter.ai/privacy. Azure OpenAI: https://www.microsoft.
com/licensing/terms/ · https://www.microsoft.com/privacy/privacystatement
#### Slack
* Sends: the channels, users, message text and names you configure; your OAuth
code or bot token; for Human Approval, the message and its approve / reject links
to the incoming webhook URL you enter — to Slack’s API, when you connect or test
a connection, when the editor loads channels, or when a Slack / Human Approval
step runs.
* Terms: https://slack.com/terms-of-service/api · Privacy: https://slack.com/trust/
privacy/privacy-policy
#### Telegram
* Sends: chat ID, message text and media URLs — to `api.telegram.org` with your
bot token, when you test the connection or a Telegram step runs.
* Terms: https://telegram.org/tos/bot-developers · Privacy: https://telegram.org/
privacy
#### Trello
* Sends: the card, list, board, member and label details you configure, with your
key and token — to `api.trello.com`, when you test the connection, when the editor
loads boards and lists, or when a Trello step runs.
* Terms: https://www.atlassian.com/legal/atlassian-customer-agreement · Privacy:
https://www.atlassian.com/legal/privacy-policy
#### Typeform
* Sends: form titles, fields and workspace, and your site’s webhook URL (the Create
Form step registers it so responses reach your workflows) — to `api.typeform.
com` with your access token, when you test the connection, when the editor loads
forms, or when a Typeform step runs.
* Terms: https://www.typeform.com/legal/service-terms-and-conditions · Privacy:
https://www.typeform.com/legal/privacy-policy
#### WordPress AI Client
* Sends: prompt, conversation history, knowledge context, tool definitions and
results, and any image you reference — to WordPress core’s AI Client, which forwards
them to the provider the site owner configured. Zaplane stores no key for it
and contacts no AI service itself.
* Terms and privacy: those of the provider configured in WordPress (see the Anthropic/
Google Gemini / OpenAI entries above).
#### YouTube thumbnails (email editor)
* Sends: the video ID, as part of the image address — to `img.youtube.com`, when
you add a YouTube link to a Video block on the Email Templates screen.
* Terms: https://www.youtube.com/t/terms · Privacy: https://policies.google.com/
privacy
#### Zoom
* Sends: meeting topics, times and settings; registrant names and emails; OAuth
codes and tokens — to `api.zoom.us` (sign-in at `zoom.us`) through your Zoom
app, when you connect or a Zoom step runs.
* Terms: https://www.zoom.com/en/trust/terms/ · Privacy: https://www.zoom.com/en/
trust/privacy/privacy-statement/
#### Addresses you configure
HTTP Request, Send Webhook, Custom Apps, the MCP Client, the AI Agent’s HTTP tool,
and the steps that read a file from a URL (CSV, Image Helper, Upload Media From
URL, AI image and audio) send data to, or fetch data from, the address you enter
or that your workflow supplies. What is sent is what you configure in that step;
the MCP Client also sends your site’s address so a server can recognise calls from
it. Requests go only where you point them, and addresses on private networks are
refused unless a developer allows them.
### Source Code and Build Process
Only one part of Zaplane is compiled: the admin interface, which is a React app.
Everything else, including all of the plugin’s PHP in `includes/` and `integrations/`,
runs exactly as it ships. The complete, uncompiled source of the admin interface
is included in this plugin, together with everything needed to build it.
#### Where the development files are
* `dev_zaplane/` — the React source: `app.js` is the entry point, `app.scss` its
base stylesheet, with `components/` (shared UI), `containers/BackendDashboard/`(
the admin screens and workflow canvas), `redux/` (store and slices), `hooks/`,`
utils/` and `webpack/` (a loader that points the email editor’s placeholder images
at `assets/images/`).
* `assets/scss/` — the Sass for the admin interface; `backend.scss` is its entry.
* `package.json`, `webpack.config.js`, `tailwind.config.js`, `postcss.config.js`
and `jsconfig.json` — the dependencies, build scripts and configuration. The
build runs on `@wordpress/scripts`, with Tailwind CSS and Autoprefixer through
PostCSS.
#### Generated files
* `assets/build/app.js` — built from `dev_zaplane/app.js` and every module it imports.
* `assets/build/app.css` and `assets/build/app-rtl.css` — built from the Sass above;
the right-to-left file comes from the same source.
* `assets/build/app.asset.php` — written by the build: the script’s WordPress dependencies
and its version.
Every generated `.js` and `.css` file starts with a comment naming its source and
the commands that rebuild it.
#### Building the admin interface
You need Node.js 18.12 or newer and npm 8.19 or newer. In the plugin’s folder, `
wp-content/plugins/zaplane`:
1. Install the dependencies: `npm install --legacy-peer-deps`
2. Build the production files: `npm run build`
The build writes minified files to `assets/build/`. While working on the source,`
npm run start` rebuilds on every save, unminified and with source maps; run `npm
run build` again before using the plugin on a live site. `--legacy-peer-deps` is
needed because one dependency, react-json-view, declares support only for older
React versions, although it works with the version Zaplane uses.
The PHP library in `vendor/` (Action Scheduler) is managed with Composer; `composer
install --no-dev` reinstalls it.
## Installation
1. Upload the `zaplane` folder to the `/wp-content/plugins/` directory, or install
the plugin through the **Plugins > Add New** screen in WordPress.
2. Activate the plugin through the **Plugins** screen.
3. Open the **Zaplane** menu in your WordPress admin.
4. Create a new automation, pick a trigger, add your actions, and turn it on.
#### Requirements
* WordPress 6.8 or higher
* PHP 7.4 or higher
## FAQ
### Do I need a Zaplane account or any external service to use this?
No. Zaplane needs no account with us and does not send your site’s data to us. You
only need an account with a third-party service (for example Slack or Mailchimp)
if you build a workflow that uses that service.
### Does Zaplane require WooCommerce?
No. WooCommerce is optional. Zaplane works with WordPress core events and with whichever
supported plugins you have installed; the available triggers and actions depend
on the plugins active on your site.
### How are scheduled and background steps processed?
Zaplane uses Action Scheduler (the same background-processing library used by WooCommerce)
to run delays, scheduled steps and long-running workflows reliably.
### Where does my data go?
Workflows, run logs and connection credentials are stored in your WordPress database.
Data leaves your site only when something you set up needs it to: a workflow step
that calls a service, testing a connection, a builder field that loads options from
a connected account (such as your Slack channels), or an AI step. Every service,
with what is sent and when, is listed under External services.
### Can workflows reach private or internal addresses?
Not by default. HTTP Request, Send Webhook, Custom Apps and every other step that
fetches a URL refuse loopback, private, link-local and reserved addresses, including
after a redirect. A developer can allow a specific internal host with the `zaplane_http_allowed_private_hosts`
filter.
### What can an AI client connected through the Abilities API do?
Zaplane registers its capabilities as abilities, and an MCP adapter you install
exposes them to an AI client. Zaplane runs no server of its own, so authentication
and transport are WordPress core’s. Every ability requires an administrator, and
the client can read your workflows, runs and recipes, draft and test workflows,
and run them. It cannot administer your site: actions that activate or deactivate
plugins, create, change or delete users, change roles or capabilities, or change
site options are kept out of its reach, and it cannot create, read, edit, activate,
test or run a workflow that uses one, including one you built yourself. You can
still use those actions in workflows you build in the Zaplane dashboard.
### Can a Custom App call PHP functions?
Only functions that code on your site has allowed with the `zaplane_custom_app_callables`
filter. A Custom App can also fire a WordPress action or filter hook of your choosing.
### Can I build multi-step workflows with conditions and delays?
Yes. You can chain multiple actions and insert delay, condition, filter, iterator
and variable steps to control exactly how and when each step runs.
### Where is the source code for the admin interface?
In the plugin itself. `dev_zaplane/` holds the React source of the admin interface
and `assets/scss/` its Sass; the files in `assets/build/` are compiled from them.
See Source Code and Build Process for where each file is and how to build it.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“Zaplane – AI Agent Automation & Workflow Builder” is open source software. The
following people have contributed to this plugin.
Contributors
* [ Kodezen LLC ](https://profiles.wordpress.org/kodezen/)
* [ Tushar Imran ](https://profiles.wordpress.org/tusharimran/)
[Translate “Zaplane – AI Agent Automation & Workflow Builder” into your language.](https://translate.wordpress.org/projects/wp-plugins/zaplane)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/zaplane/), check out
the [SVN repository](https://plugins.svn.wordpress.org/zaplane/), or subscribe to
the [development log](https://plugins.trac.wordpress.org/log/zaplane/) by [RSS](https://plugins.trac.wordpress.org/log/zaplane/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.5.0
**Added**
* Inbox module: website live chat, Facebook Messenger and WhatsApp channels,
selling in chat with product cards, saved replies and quick-answers, automatic answers
from Business Knowledge, agent presence and business hours, email-capture gating,
typing indicator and realtime delivery. New triggers and actions so workflows can
read, reply to and route conversations. * Third-party integration API: other plugins
can register their own triggers and actions with `zaplane_register_integration()`
on the `zaplane_register_integrations` action. See `docs/integrations/third-party/
README.md`. * `wp zaplane make:addon ` scaffolds a ready-to-edit plugin with
a sample third-party integration (or adds one to an existing plugin with `--plugin
=`). * New built-in integrations: Shopify, Google Sheets, Google Docs, JetFormBuilder,
Forminator, Everest Forms, HappyForms, Gutena Forms, Tally Form, QuizPress, Easy
Content Manager, TruePlayer, WP Map Block, GemBoard, ZenAppBuilder. * AI Agent:
Chat Model, Memory and Tool slots with a slot-aware picker and a `zaplane_agent_slots`
filter; a Chat Model’s own connection decides the provider; Memory can read Inbox
conversations. * Workflows list: filter by status and folder, search, “Clear filters”
affordance; Connections list: status tabs, app filter and search. * Editor: tidier
step connection picker opening the shared “Add connection” modal; missing-connection
notice as a card over the canvas; workflows the editor flags when a step has no
connection. * Settings: a gear button per module opens its settings; multi-WordPress
support for the WordPress integration.
**Changed**
* Minimum WordPress is 7.0. * Many editor polish passes: top-bar logo
and spacing, Create Workflow modal rhythm, Add Trigger drawer, email-template editor
layout.
**Fixed**
* `determine_current_user` settings recursion. * Workflow re-triggering
itself from its own actions. * Custom Code Execution: process timeouts actually
terminate on Windows. * ORM `where()` on a column named like a function no longer
filters out everything. * Silent no-op actions, formatter and repeater limits, MCP
stream parsing. * Inbox: rate-limit the chat widget per visitor on a real one-minute
window; don’t run reply workflows for conversations others answer; match chat spellings
and pages whose text covers the question. * Plain-permalinks sites, align plugin
header with new readme title, scroll-to-top on sidebar navigation.
**Security**
* Remaining user-URL HTTP routed through `HttpGuard`; PCRE formatter
hardened. * Security and WPCS audit of PRs merged for this release.
#### 1.4.0
**Changed**
* AI access now uses the WordPress Abilities API instead of Zaplane’s
own MCP server. Zaplane registers its workflow capabilities as abilities; install
an MCP adapter and an AI client you approve can discover, build and run workflows
through WordPress core. Every ability requires an administrator, and site-administration
actions stay out of an AI client’s reach. * Removed the built-in MCP server, its
OAuth sign-in, access tokens, and the “AI access” settings and log screens. * Raised
the minimum WordPress version to 6.8. Abilities and the core AI Client are consumed
through the Abilities API when the hosting WordPress version provides them. * The
MCP Client workflow step (calling other services’ MCP servers) is unchanged.
#### 1.3.3
**Security**
* A workflow that another service starts — a Catch Webhook URL, a
provider webhook, or a trigger from a connected outside account — can no longer
run actions that administer the site: activating or deactivating plugins, creating,
changing or deleting users, changing roles and capabilities, and changing site options.
Such a workflow cannot be activated, the editor explains why, and the step is refused
if one runs anyway. The same actions still work in workflows started by something
that happens on the site. * An AI Agent is never given those actions as tools. *
The Academy and ZenCommunity steps no longer switch the signed-in user while they
run; they act for the user they name. * MCP access tokens now sign in through WordPress’s
own authentication filter, the one application passwords use, instead of switching
the user inside the endpoint.
#### 1.3.2
**Security**
* An AI client connected through the MCP server can no longer reach
actions that administer the site: activating or deactivating plugins, creating,
changing or deleting users, changing roles and capabilities, and changing site options.
It cannot add them to a workflow, or read, edit, activate, test or run a workflow
that uses them.
**Fixed**
* Conditions, filters and a few triggers no longer call string functions
that need PHP 8, so Zaplane runs on PHP 7.4 as declared. * Workflow steps now run
when Action Scheduler is processed from WP-CLI, as many hosts do from a system cron.
Before, every queued step failed there.
#### 1.3.1
**Security and privacy**
* Removed the Switch Theme and Authenticate User actions.
Which theme a site runs, and signing in, are the site owner’s own decisions. * Create,
Update and Delete User now accept only the fields their form offers and a role the
site defines, and refuse to delete the last administrator or the account the run
is using. * Incoming webhook and Catch Webhook URLs check the provider’s signature,
or the trigger’s shared secret, before the request reaches the workflow. * The workflow
query builder now refuses any table, column, operator or sort direction that is
not a plain name, and every value it sends is a placeholder filled in by WordPress.*
The admin palette, the integrations catalogue and the MCP consent screen are escaped
on the way out. * Documented the Telegram API address and the links to claude.ai
and ChatGPT under External services.
**Fixed**
* Lists of courses, quizzes, ranks and achievements are read through
WordPress instead of the posts table directly. * Fixed selecting a specific set
of columns — a “get this field for every row” query returned nothing.
#### 1.3.0
**Workflows**
* A workflow can start from more than one trigger. Whichever fires
starts the run, and `{{trigger.*}}` reads its data. * Connecting steps is easier:
drop a line anywhere on a step’s card, and letting go on empty canvas opens the
step picker.
**Recipes**
* Group recipes set up several workflows at once in a new folder, starting
with WooCommerce Customer Lifecycle and StoreEngine Store Emails. * Every recipe
opens a setup for its optional steps, settings and connections. Plugins can register
recipes as simple arrays.
**AI**
* The AI, AI Agent and Generate Image steps use the WordPress AI Client
when it is available in core, including the agent’s tool calling. Your own provider
key is still an option.
**AI access (MCP server)**
* claude.ai and ChatGPT can connect through OAuth, with
administrator approval. WordPress application passwords also work. * Tool calls
are logged, tokens can expire, and run tokens can be limited to chosen workflows.
**Security and compatibility**
* Merge tags are no longer evaluated as PHP, and
outbound requests are checked on every redirect. * MCP tokens now act as their own
user and require administrator rights. * Updates come only from WordPress.org. WordPress
6.8 or later is required.
**Fixes**
* GemCRM Send Email now reaches only the chosen contact or list. * Fixed
shipped recipes’ Send Email steps, duplicate recipes after a rename, fields with
hyphens, forms watched by two triggers, and Logs Re-Try.
#### 1.2.0
**New integrations**
* aBlocks — a Form Submitted trigger for aBlocks form-builder
forms. * FluentCart — 21 new triggers and 52 new actions across carts, coupons,
licences, customers, orders, products and subscriptions.
**AI access (MCP server)**
* Let Claude, Cursor or any Model Context Protocol client
read your automations and build new ones from a plain-language description. Off
by default, behind scoped and revocable tokens.
**Modules**
* Optional features are now opt-in and switched off on a fresh install.
Existing sites keep whatever they had. * A card on the Workflows, Dashboard and
Connections screens lists what you have not turned on, with a one-click switch.
Picking a step whose module is off now says so in the builder and offers to enable
it there.
**Workflow canvas**
* Nodes are colour-typed as trigger, action, tool or AI, on
the card and on the connector leaving it, so a glance shows what feeds what. * Node
cards now sit on a canvas of their own colour instead of sharing it, connectors
draw a single stroke instead of three, and the delete control is a real, keyboard-
reachable button.
**Appearance**
* The dark theme was rebuilt for legibility — secondary text and
button labels previously fell below the accessible contrast minimum. * The dashboard
chart now follows your palette instead of fixed light-mode colours.
**Performance**
* The admin bundle drops from 23.8 MB to 1.6 MB.
**Removed**
* The Dokan “Withdraw Request Pending” and FluentCart “Order Paid Done”
triggers. A workflow still using either will need its trigger re-selected.
#### 1.1.0
**New integrations**
* StoreEngine — order, subscription and product triggers plus
actions. * AI (Chat Model) — generate replies with Anthropic, OpenAI, or WordPress
Core AI. * AI Agent — autonomous tool-calling agent with Chat Model, Memory and
Tools sub-nodes, plus MCP server support. * Conversation Memory — durable, keyed
chat history for AI conversations. * Business Knowledge — a searchable knowledge
base the AI Agent can query; sync from StoreEngine products. * Custom Apps — build
your own integrations (REST or same-site WordPress hooks) without code changes. *
Webhook — a dedicated app for both directions: Catch Webhook (incoming) and Send
Webhook (outgoing) with optional HMAC-SHA256 signing. * Messenger and WhatsApp —
AI auto-reply flows. * Academy — course enrolment triggers, actions and access-group
membership.
**New tools & flow control**
* Manual Trigger, Schedule trigger, and Human-in-the-
Loop approval. * Router (multi-branch), Repeater/Iterator, Condition and Filter.*
Utility tools: CSV, XML, JSON Parser, Formatter, Date/Time, Image Helper, Set Variable,
and Sticky Note.
**New recipe**
* “AI Reply to Incoming Webhook” — receive a question by webhook,
answer it with the AI Agent using your Business Knowledge, then post the reply back
out.
**Improvements**
* Dynamic-data “@” token picker across expression fields, with
sample outputs so tokens are available before a test run. * Redesigned Business
Knowledge, field, checkbox and connection-icon UI, with icon fallbacks. * Clearer
node port / branch handles and AI Agent sub-node handles on the canvas.
**Fixes**
* AI and AI Agent no longer appear as trigger options where only actions
apply. * Custom Apps: trigger firing, label handling, and the stale generic “Custom
App” entry in the app picker. * Webhook: structured Body fields so multi-line/quoted
values (e.g. an AI reply) can’t produce malformed JSON. * Node port, multiple-output,
route-indicator, CSV parser, and dynamic-data resolution fixes.
#### 1.0.2
* Improvements and bug fixes.
#### 1.0.0
* Initial release.
## Meta
* Version **1.5.0**
* Last updated **9 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.8 or higher **
* Tested up to **7.0.7**
* PHP version ** 7.4 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/zaplane/)
* Tags
* [AI agent](https://kea.wordpress.org/plugins/tags/ai-agent/)[automation](https://kea.wordpress.org/plugins/tags/automation/)
[integration](https://kea.wordpress.org/plugins/tags/integration/)[webhook](https://kea.wordpress.org/plugins/tags/webhook/)
[workflow](https://kea.wordpress.org/plugins/tags/workflow/)
* [Advanced View](https://kea.wordpress.org/plugins/zaplane/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/zaplane/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/zaplane/reviews/)
## Contributors
* [ Kodezen LLC ](https://profiles.wordpress.org/kodezen/)
* [ Tushar Imran ](https://profiles.wordpress.org/tusharimran/)
## Support
Issues resolved in last two months:
0 out of 1
[View support forum](https://wordpress.org/support/plugin/zaplane/)