Andy Beal Livea tumblelog

WordPress “Timthumb” Malware Exploit Warning

This is a general PSA…cos I like you!

Trackur’s WordPress theme was injected twice with malware in the past 2 months. The first time around, we cleaned it up and thought we prevented it from happening again. Unfortunately, it happened again just yesterday.

We did some further digging and discovered that we were not the only ones suffering. Just about anyone using WooThemes for their theme or the Timthumb script are at risk—unless you have either updated your WooThemes framework or your Timthumb code.

The easiest way to do the latter is to use the Timthumb Vulnerability Scanner plugin.

This plugin checks to see if you are using the vulnerable, outdated script and then automatically updates it.

It’s worth running the plugin just to be safe. You may be using the Timthumb script (it’s used to create thumbnail images) without even knowing it.

Trust me, you don’t want to deal with cleaning up a malware attack.

posted 3 months ago