2026-10-07 – version 2.9.4
* Fix – Replaced public quote PDFs with private temporary attachments and removed legacy Quotes.pdf files.
* Fix – Disabled remote resources, PHP execution, and JavaScript in PDF rendering; external/CDN images are omitted.
* Fix – Added permission checks to administrative AJAX actions and single/bulk PDF downloads; bulk downloads also require nonce validation.
* Fix – Enforced quote ownership, approved status, and enabled settings for customer conversions.
* Fix – Enforced ownership for current and legacy My Account quote details.
* Fix – Restricted quote, rule, and field administration to WooCommerce managers.
* Fix – Protected quote uploads with authorized downloads, signed guest links, and Apache/IIS access rules. Nginx requires equivalent rules.
* Fix – Validated cart conversion quote status and tokens, and corrected guest customer handling.