Shortcodes

Last updated Oct 3, 20264 min read

Two shortcodes print values anywhere shortcodes run: post content, widgets, page builders and do_shortcode().

`[wpmcf_field]`

Prints one field value, escaped, through the same code as wpmcf_the_field() (see Output formats and escaping).

[wpmcf_field group="listing" field="price"]
[wpmcf_field group="listing" field="price" id="42" wrap="false"]
[wpmcf_field group="profile" field="bio" context="user" id="3"]
[wpmcf_field group="site_settings" field="company_name" context="options"]

Attributes

Attribute	Default	Description
`group`	required	Field group key. Without it (or without `field`) nothing is printed.
`field`	required	Top-level field key.
`id`	`0`	Object ID. `0`, empty or non-numeric means the current object (the current post inside the loop).
`context`	`post`	`post`, `user`, `term`, `comment`, `widget` or `options`. Unknown values read as `post`.
`format`	`auto`	`auto`, `html`, `attr`, `url`, `js`, `post_html`. Others fall back to `auto`.
`path`	none	Dot path inside a Group or Repeater value: `path="city"`, `path="1.name"`.
`sub_key`	none	One-segment shortcut for `path`.
`default`	none	Printed (escaped) when the field has no value (never saved or cleared). Only applies when you write the attribute: `default=""` prints nothing.
`wrap`	`true`	`false`, `0`, `no`, `off` or an empty/unknown value remove the `<span class="wpmcf-field-value">` wrapper and the field's prefix/suffix. `true`, `1`, `yes`, `on` keep it.
`widget_sidebar`, `widget_id_base`, `widget_number`	none	Name the widget when `context="widget"` and no `id` is given.

Group, field, context, format and sub_key values go through sanitize_key(), so group="LISTING" works. Unknown attributes are ignored.

Because the shortcode takes an id, it accepts IDs and contexts only, not reference strings like user_3: use context="user" id="3".

Examples (verified)

Shortcode	Output
`[wpmcf_field group="g" field="title" id="5"]`	`<span id="…" class="wpmcf-field-value …">[Hello]</span>` (wrapper with the field's display settings)
`... wrap="false"`	`Hello`
`[wpmcf_field group="g" field="details" id="5" path="city"]`	the `city` value
`[wpmcf_field group="g" field="items" id="5" path="1.name"]`	the second row's `name`
`[wpmcf_field group="g" field="price" id="5" default="n/a"]`	`n/a` when empty
`[wpmcf_field group="g" field="tags" id="5"]`	`Red, Blue` (checkbox labels)
`[wpmcf_field group="g" field="site" id="5" format="url"]`	`https://example.com/a?b=1&c=2`

`{{ }}` expressions

Expressions inside a field value are resolved under the same rule as wpmcf_get_field(): only when the value's author may use unfiltered HTML. See Reading values.

Who can see what

Shortcodes (like blocks) can be typed by contributors, so an explicit id may only point at things the current visitor could see anyway. Anything else prints an empty string. The PHP functions are not restricted, because theme code is trusted.

`context` and `id`	Printed when
`post`	the visitor has `read_post` for it, or it is publicly viewable (published); and it is not password-protected, unless the visitor can `edit_post` it. Drafts and private posts are therefore hidden from other people.
`user`	it is the current user, or the author of the post being viewed (author boxes), or the visitor has `list_users`
`term`	the term's taxonomy is publicly viewable
`comment`	the visitor can `edit_comment`, or the comment is approved and its post is viewable
`options`	see below
no `id` (current post)	not checked: it is the page being rendered

Options values (context="options") inside post content print only when the post's author has the capability of an options page that shows the group: manage_options by default, or the capabilities returned by the wpmcf/options/capabilities filter. A contributor therefore cannot publish your options-page values by writing a shortcode. Outside post content (a template, a widget) the value prints; during REST and Ajax requests (editor previews) the current user needs the capability.

The filter wpmcf/shortcode/can_view (arguments: visible, context, object ID) overrides every decision above:

php

add_filter( 'wpmcf/shortcode/can_view', function ( bool $visible, string $context, int $id ): bool {
    return $context === 'user' ? true : $visible;   // show every user's fields
}, 10, 3 );

Verified matrix (field title set on every object):

Object	Admin	Subscriber	Logged out
published post	yes	yes	yes
private post	yes	no	no
draft	yes	no	no
password-protected post	yes	no	no
the subscriber's own user	yes	yes	no
another user	yes	no	no
term	yes	yes	yes
approved comment	yes	yes	yes
pending comment	yes	no	no

Password fields

A Password field never prints through the shortcode, for any format, unless the wpmcf/field/the_password filter allows it. See Password helpers and security.

`[wpmcf_global]`

Prints a Global Data variable, escaped, like wpmcf_the_global().

[wpmcf_global key="phone"]
[wpmcf_global key="phone" wrap="false"]
[wpmcf_global key="site_url" format="url" wrap="false"]

Attribute	Default	Description
`key`	required	Variable key. Case-insensitive (`sanitize_key()`).
`format`	`auto`	`auto`, `html`, `attr`, `url`, `js`, `post_html`. `auto` escapes by variable type (URL variables with `esc_url()`, everything else with `esc_html()`).
`wrap`	`true`	Same rules as above; the wrapper class is `wpmcf-global-value`.
`default`	none	Printed (escaped) when the variable is missing or empty. `{{ }}` expressions in the value are resolved.

There are no visibility rules for [wpmcf_global]: Global Data is site-wide and public by design. Password variables never print.

Using shortcodes in PHP

php

echo do_shortcode( '[wpmcf_field group="listing" field="price" id="' . (int) $post_id . '"]' );

Prefer wpmcf_the_field() in templates; it avoids shortcode parsing and accepts reference strings.

Troubleshooting

Symptom	Cause
Nothing prints	The value is empty; a Password field; the visibility rules above (private, draft, password-protected, another user); a typo in `group` or `field`.
Raw `[wpmcf_field ...]` text appears	The place does not run shortcodes. Wrap in `do_shortcode()`, or use a shortcode block.
An `<a>` or HTML shows as text	Use a field type whose `auto` format is HTML (Link, Image), not `format="html"` which escapes.
Wrapper span is unwanted inside an attribute	Add `wrap="false"`.

Was this page helpful?

Still stuck? Contact support