Changelog

Discount coupon import (CSV and copy‑paste) now supports metadata ‑ discount type (percentage or fixed), value, currency, minimum spend and shipping. Metadata is displayed in the folder detail and in the import dialog. After import, a summary shows the number of newly added, updated and skipped coupons. Existing coupons can now be updated by re‑importing with the same code ‑ metadata is overwritten and existing coupons are not added again. The /coupons/import API endpoint accepts the same metadata as the manual import.

The IdoSell integration now regularly synchronises the product catalogue, not just on first connection. Changes in products (price, availability, description) are now automatically reflected in Ecomail.

The ECM_BASKET merge tag with a feed ID (ECM_BASKET__) evaluated as empty in the Shopify integration, even when the product from the cart existed in the feed. The cause was a key mismatch between the Shopify builder and the general product matching code. Cart‑to-feed matching now works the same as with other integrations. The general ECM_BASKET merge tag (without a feed) was not affected.

For domains with multiple TXT records, the DMARC value was displayed incompletely or split. The DMARC record display is fixed.

When a campaign failed to send, a generic error message was shown without a specific reason. The message now describes what went wrong.

In the template overview, the checkbox for bulk selection was not displayed for individual templates. The display is fixed.

The Activities section of a campaign report now has a Smart delivery tab listing contacts whose send was skipped by smart delivery, including the reason (priority quarantine or frequency cap). The tab only appears for campaigns where smart delivery was active. As with other activity tabs, pagination, sorting by date, full‑text email search and CSV export all work the same way.

In some cases, the Ecwid integration disconnected on its own shortly after reconnecting a store ‑ typically after reinstalling the add‑on or changing the connected list. The issue is fixed.

If a node in an automation had more than one follow‑up step connected to a single output, the export could in certain cases only carry over the first one. The export now accounts for all follow‑up steps on every output.

For links placed next to each other on a single line (typically navigation), the click count labels overlapped and only the last one was visible. For links with a comma or other encoded character in the address, the label did not appear at all, even though the clicks were recorded correctly. The click map label display is fixed.

PHP's maintainers released patches for two critical vulnerabilities, CVE‑2026-109618 and CVE‑2026-109619, which would have let an attacker run arbitrary code on a server without knowing any password. The vulnerability did not originate in Ecomail ‑ it affects every server running PHP. Immediately after the patches were released, we updated PHP on all Ecomail servers to the latest version, reviewed our infrastructure, and we continue monitoring traffic for suspicious activity. If you use Ecomail only through the web interface, you don't need to do anything ‑ your account is safe. If you have your own PHP‑based website, e‑shop or application connected to Ecomail, check the PHP version on that server and update it to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 ‑ that's typically where the API key is stored. If you suspect the key may have leaked, generate a new one in Settings ‑> Integrations ‑> API key. Not sure how to proceed? Forward this message to your developer or hosting provider.