TimThumb Vulnerability

I received an email from a buyer today linking me to a post made by a blog owner about a serious vulnerability in timthumb that led to his site being hacked. I don’t use timthumb in my themes but I know a lot of people do so I thought I would post it here to make sure authors are aware of the problem and can apply fixes to their themes.

Article is here: http://markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/

Thanks for posting this Eugene. I’m actually working on a site that’ll use the script and this is good to know. Appreciated

This will start a frenzy among customers… already started with our themes.

I’ve already updated

ThemeProvince said
I’ve already updated

This is what i am doing now

duotive said

ThemeProvince said
I’ve already updated

This is what i am doing now

Likewise, I’m updating my themes ASAP .

ChrisMooney said

duotive said

ThemeProvince said
I’ve already updated

This is what i am doing now

Likewise, I’m updating my themes ASAP .

Done and accepted :)))

This issue was fixed in the version 1.34 (diff), so you don’t have to remove all allowed sites – just update your TimThumb script to the latest version.

e404 said
This issue was fixed in the version 1.34 (diff), so you don’t have to remove all allowed sites – just update your TimThumb script to the latest version.

Thanks will be updating now

As a “buyer” I went through the panic of checking all our sites and checking/replacing the latest version of timthumb.php (renamed to thumb.php by some). So for the help of other buyers out there I can confirm that at least the following do use instances of timthumb….

PLUGINS (timthumb.php)—> Sugar slider

WP THEMES (timthumb.php)—> CONCISE , CORPORATE, PUREVISION , LEVITATION, CLOCKSTONE , RTTHEME6, LOTUS , SINTAGMA, DANDELION , BIG FEATURE , INNOVA, AMPLIFY

WP THEMES (thumb.php)—> INFOCUS