We’ve decided to do something a little out there…
Everyone has an AI that can read code now (among other dangerous things), and plenty of people are pointing theirs at WordPress plugins, ours very much included. So we’re making it official. From today until November 30, we want you to point yours at Events Manager and try to break it.
Find a real security vulnerability, report it to us privately, and we’ll put your name on the scoreboard, pay you in Events Manager Pro license time, and fix it before anyone else gets the chance. Whoever is top of the scoreboard on November 30 wins a lifetime Events Manager Pro license.
Join the hunt at wp-events-plugin.com/security
Why we’re asking for it
Security reports have been arriving faster this year than at any point in the plugin’s history. We’re not the only ones; WordPress itself has introduced its own countermeasures to combat this new phenomenon.
Some come out of our own AI-assisted reviews, and many come from researchers using the same kind of tools, who report through Patchstack, Wordfence and similar programs. Those programs do good work and we’re grateful for every report, but they reach us on someone else’s timeline, and now and then an issue gets flagged publicly before we have a fix out. The race condition fixed in 7.4.9 was one of those.
The best report we’ve had this year didn’t come through any of them. It came from a customer, who ran his own AI review of the plugin and sent what he found straight to us which ended up as the 7.4.8 update. That’s the kind of report we want more of, from people who actually run Events Manager and have every reason to want it locked down.
We’re not scared of what you’ll find. We don’t want someone else finding it first and exploiting it. So we’re opening the doors of Pandora’s box.
How it works
- Set your AI loose. Any AI tool you like. Events Manager is on wordpress.org, and Pro license holders can download Pro and the add-ons from their account. The hunt page has a starter prompt if you want one.
- Prove it’s real. Make it happen on a clean install of the latest version, on a site you own. AI tools cry wolf a lot (we’ve waded through plenty of those ourselves), and we only score what actually works.
- Paste the write-up. The hunt page also has a report prompt that gets your AI to write the finding up in the format we triage from. Paste what it writes into the form and you’re on the board. No account needed, just your email.
What’s on the table
Pro time goes onto the license for your email, or a new license if you don’t have one, up to 24 months per person. The lifetime license for whoever finishes on top is on top of that, and if two people tie, it goes to whoever got there first.
For more information on the rules and how to submit, visit our new security hunt page.
The sale is back too
7.4.9 was a security release and we want as many sites as possible on current versions, so our recent sale is back for the meantime: up to 35% off Events Manager Pro on new licenses, upgrades and renewals, including renewing early. An active license is also what gets you Pro’s own security fixes, so if yours has lapsed, now is a good time to renew.
Happy hunting… and if you’d rather keep reporting the way you do now, security@wp-events-plugin.com still works.