If you run your website(s) using WordPress, this affects you!

I don’t know a lot about hacking, etc, and I’m definitely not a “propeller head” so this information is not intended as a diagnosis or full protection… BUT, one of my sites was recently exploited by this vulnerability and yours could be too, so I want to pass on the information I’ve uncovered.

Much of this info is thanks to Jeff Johnson, who shared it with his subscriber list.  I’m doing the same in turn to help you protect yourself against this vulnerability.

THE PROBLEM IN A NUTSHELL

Many WordPress-based blogs and websites use an image resizing script called “timthumb” and old versions of this script have a vulnerability to that allows hackers to upload and execute malicious software.

In my case, they installed phishing software that was mass spamming by email.  My hosting company realized what was going on and, to protect all of their clients, not only shut down this one site… but shut down ALL of my sites.

And I understand why.  They need to protect the integrity of their servers and if hackers got one of my files, there’s a chance they got more.

HOW TO UPGRADE THIS FILE

The developers of the timthumb file have created an update to fix this vulnerability.  You can quickly scan your wordpress installation for any instances of this plugin using a free plugin called “TimThumb Vulnerability Scanner” and then upgrade it instantly right from the control panel.

I walk you through the installation, scanning & upgrading process in this video:

[jwplayer config=”PK” file=”https://s3.amazonaws.com/keetch/Public-Service-timthumb.mp4″ html5_file=”https://s3.amazonaws.com/keetch/Public-Service-timthumb.mp4″]

IMPORTANT:

If you’ve installed a custom theme or a premium theme (including the OptimizePress) you should definitely run this scan!

To safe and happy webifying!


    4 replies to "WordPress Tim Thumb Vulnerability"

    • Deberah

      I checked with Optimize Press re this issue. Their response (below) may be helpful to everyone who uses OP.

      Jonathan, Feb 08 18:54 (GMT):
      Hi Deberah
      We have patched the timthumb file in OptimizePress in versions 1.4 and above – please ensure you are running the latest version of OP (currently 1.45) and you will have no risk from the TimThumb file. We run OptimizePress on many of our own sites and would not allow it to run if we thought that there was a security risk
      Unfortunately many themes were affected with the timthumb issue but we released a patch very soon after discovering this issue
      Please let me know if you have any further questions or concerns and please pass this onto Christine if you feel that is relevant
      Kind Regards,
      Jonathan
      OptimizePress Support Team

      Note to Optimize Press, Feb 08 17:42 (GMT):
      Hi there,
      I got an email from Christine Comaford, whom I trust, about optimize press (which she has recommended in the past) being vulnerable to hacking. She sent this link which discusses the problem.
      http://www.paulkeetch.com/blog/wordpress-tim-thumb-vulnerability/
      I’d appreciate knowing your thoughts on this. Do I need to do something?
      Thanks,
      Deberah

      • Paul Keetch

        Hi Deberah – thanks for checking with OptimizePress on this and reporting back. If you’re running OP, either upgrade the theme to fix the vulnerability or use the video above to fix it without upgrading.

    • Charlene Christiano

      This is the second time in 2 days that I heard someone’s site was hacked. Thanks for this great information. I have a premium them, and bought Optimize Press to use for another site. This will definitely come in handy. Thank you for the information.

    • Pearl Roth

      Paul, In the process of checking all my WP installs, thanks so much for sharing this piece of information.

Leave a Reply

Your email address will not be published.