Fix for TimThumb vulnerability

A serious vulnerability was recently discovered in the popular TimThumb script. TimThumb is a tool that is used to manipulate images, and is used by many themes and plugins. This vulnerability may allow users to execute certain malicious commands on affected servers.

If you subscribe to VaultPress Premium, we’ve already scanned your site for this vulnerability, and have sent email notifications to affected users. We’ve also launched a fixer that will allow you to patch vulnerable code with a single click. You can run this fixer from the Security page in your VaultPress dashboard.

All other VaultPress users should refer to their theme and plugin documentation, or contact their developer, to determine whether they are using TimThumb. You can also search your server for timthumb.php. If you’re running TimThumb, you should ensure that the vulnerable WebShot feature is disabled in timthumb.php.

You can manually disable the vulnerable WebShot feature in a few steps:

  • Locate the TimThumb script inside your themes and plugins. Generally the file will be named timthumb.php.
  • Open timthumb.php in your favorite text editor.
  • Search the file for WEBSHOT_ENABLED and ensure it is set to false.

As always, drop us a line if you have any questions!

About Chris

I work and play at WordPress.com, and spend my offline time drinking chai tea and running around in parks.
This entry was posted in Security. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s