Important! Timthumb upgrade

Recently a security flaw was identified in the Timthumb – an image cropping and resizing library commonly used in wordpress themes. This flaw could be exploited by a hacker to embed malware in your site. Luckily the flaw was identified by a good soul Mark Maunder and alerted the community about it. Not only he got the word out but he also started working on rectifying the timthumb script from ground up and was later joined by the original timthumb creator. Together they have released an upgrade for the timthumb script and it is called Timthumb-2. It is available here – http://timthumb.googlecode.com/svn/trunk/timthumb.php

Now, it is important that anybody using WordPress themes with timthumb library to immediately upgrade the timthumb.php file. You can download the new version of timthumb from the link above and just replace the old version of timthumb in your theme. The new version is secure, fast, and a lot light on the server.

I have upgraded my themes which uses timthumb. So you can either re-download a theme or you can just replace the timthumb file alone in your theme with the new version – http://timthumb.googlecode.com/svn/trunk/timthumb.php . If you are using a theme from web2feel or from other theme authors with timthumb library, it is highly advisable you make this upgrade as early as possible

Remember this: Any theme in your wordpress themes directory with an old version of timthumb file could make your site vulnerable. It is not necessary to be the active theme.   Make sure not leave any old theme unchecked for this vulnerability.

  • Anastasy

    THANKS!!!!!!!!!!

  • bob_n1tro

    then answer it here:http://www.web2feel.com/prado/

  • bob_n1tro

    then answer it here:http://www.web2feel.com/prado/

  • bob_n1tro

    then answer it here:http://www.web2feel.com/prado/

  • D Forums

    Soo how do we fix the Stargaze theme

    • Anonymous

      Nothing to fix on stargaze because it does not use timthumb. But if you have any other theme with old version timthumb  in your themes directory, then you are vulnerable. You may either delete the theme or update its timthumb file.

  • http://twitter.com/aionthegame Bosch

    I can’t seem to find timthumbs php file , where is it??

    I receive error form my WP firewall:

    http://www.aionthegame.com/wp-content/themes/royalle/tools/timthumb.php?src=/g0../0d1.gif
    Warning: URL may contain dangerous content!
    Offending IP:   67.222.51.16 [ Get IP location ]
    Offending Parameter:   src = /g0../0d1.gif

    (BTW I don’t have any theme or folder called royalle, I have stargaze installed)

    • Anonymous

      It looks like an attempt to attack your site. As long as you do not have any theme with old timthumb you are safe.

  • http://www.nepalifmonline.com Aashish

    so do we need to update it manually ?

  • http://www.stock24x7.com/ saumil

    i dont think that a big issue …

  • http://www.cellcustomize.com Raakaysh

    How to upgrade it.

    http://celcustomize.com

  • http://www.devangvisaria.com Nilesh Shukla

    Hey, very nice site. I came across this on Google, and I am stoked that I did. I will definately be coming back here more often. Wish I could add to the conversation and bring a bit more to the table, but am just taking in as much info as I can at the moment.

    Thanks & Regards,
    Stock Market Tips

  • Anderson Ferro

    Hello,
    I’m using TIBERION, but even with the update file giving the problemcontinues Timthumb Malware.

    Only appears in: http://blog.andersonferro.com.br/ -
    By accessing another internal pages of the blog does not appear the problem.

    ** I’ve done the update file, and have no other issue in my directory,only the thiberion could help us?

    Thanks,

    Anderson Ferro

    =======================

    Olá,Estou usando o TIBERION, porém mesmo com a atualização do Arquivo Timthumb continua dando o problema de Malware.Só aparece em: http://blog.andersonferro.com.br/ - Ao acessar outra pagina interna do blog não aparece o problema.** Já fiz a atualização do arquivo, e não tenho nenhum outro tema dentro do meu diretório, somente o thiberion, poderia nos ajudar ?

    Obrigado,Anderson Ferro

  • osman Sajjad

    hello sir, i like you post too and ask you to write about my site which is http://www.iconwanted.com and submit a blog post for my site in your blog

  • http://www.jacquelynfisher.com Jacquelyn Fisher

    Thanks for this heads up! Changing to the new timthumb file fixed an image problem I was having on the Scarlett theme.

    ~Jacquelyn

  • Rajubutt4
  • Rajubutt4
  • Rajubutt4
  • http://latestpricelistindia.in/ Parag

    It would be nice if we could use add_image_size in the same fashion, but that only impacts images uploaded after the fact… with the dynamic resizing we can set the sizes at any time….

  • http://pulse.yahoo.com/_3KFTPA322UDDXJOY3W74TC6MUU Zhang

    In 1974, new owners HVAC
    parts
    switched WQTE from Easy Listening to Car
    Accessories
    of the 1950s and 1960s as WHND, ” Drivetrain,”
    shadowcasting auto
    electronics
    94.7 FM. The small strip of land surrounding the mouth of
    the Car Care
    Products
    was under the jurisdiction of the Michigan Territory, because
    the borders originally drawn up for the Plastic
    Parts
    of 1787 set a territorial boundary as the southernmost edge of
    Brake
    Hose
    .

  • Newsgadgetsnews

    thanks for your theme. i like scarlet look this new gadget news

  • http://www.enhancementresearch.com research

    Thanks for letting us know! I guess there are still are those who are willing to do good instead of exploiting everyone out there. Of course, there are going to be many who will not see this message or update their themes… so here goes another wave of hijacked sites…

  • http://www.dessaasansor.com/ asansör

    thank you a like it.

  • http://www.dessaasansor.com/ asansör

    thank you a like it.

  • Andreu Camps

    Thank yo for the timthumb upgrade, but Is there any upgrade for the whole Eminent theme? I tried to upgrade the timthumb by copying the new one instead the other by It doesn´t work…
    My problem is that the  picture of each entry shown in the slide show area doesn´t appears.
    Can anybody help me

  • http://www.paulsmithsale.uk.com/ paul smith uk

    abc123

  • Jordan

    why i can see any thumbnail images ?

    I’m using Yalene and php5 gdlib is working on my server.

  • Exdykee

    well nice stuff you have here , it work well but i was having this message i will like to know what to do, if you can help? Check it out here pls!!  Thanks

  • http://yoursinfo.com/ ajmal

    thank you

  • http://www.fresh-seo.co.uk/ SEO Surrey

    Thanks for the fix I will be deleting the old themes that I don’t use…

  • Renanmaximo

    Thank you!!!!