Latest ThemeShift News

Theme Updates Due to TimThumb Vulnerability

→ August 3, 2011 in News

Yesterday I found this blog post reporting a security issue in the TimThumb image resizing script used in some of my older themes. Please read this carefully to find out if your theme is affected and how to fix it.

What’s the problem?

In a few words the script may give access to hackers to place and execute scripts with malicious code on your server.

Is my theme affected?

The following themes still include the TimThumb script. If your theme is among these, please read the rest of this post carefully. If not, there is no need to read further.

→ deCasa
→ deCondo
→ deGusto
→ deLuxe
→ deNovo
→ deZine
→ deStyle

How can I fix this?

There are two ways to easily fix this issue. You can either update the theme or you just replace the TimThumb script with an updated version. Either way, I strongly recommend to update the script..

Either Update Theme

1. Download latest version with your download link
2. Deactivate and remove old version
3. Install new version

Or Update Script

1. Access your server via FTP and find the following file:

/wp-content/themes/**themename**/lib/scripts/thumb.php</pre>
<p>2. Download the (updated) <a href="http://themeshift.com/files/thumb.zip">thumb.zip</a> file<br />
3. Unpack the archive<br />
4. Replace the file <code>thumb.php in the above-mentioned folder on your server

Further Information

Zero Day Vulnerability in many WordPress Themes
WordPress Themes Using TimThumb Under Attack
TimThumb project page

Comments

  
  1. I’m looking to buy theme from you.I would like to know if we get life time updates when there are vulnerabilities found

  2. Hi Peter, thanks for your interest in my themes! Yes, you do get lifetime updates. Also, only some older themes still had the TimThumb script included. These were created when WordPress still had no image resizing features on board.

  3. Wow, i noticed one of your themes on a casino website. I bet they paid you guys well to use your template as their website. Good work ThemeShift Team: http://playcasinoroyale.com
    deCanto is a good looking theme…

Trackbacks

  1. [...] Theme Shift – update theme or change code to latest version of timthumb [...]

  2. [...] themes. Their themes were updated, though version numbers weren’t bumped. Graph Paper Press, ThemeShift, and ThemeLab have updated the versions of TimThumb within their themes as well. Elegant Themes [...]

  3. [...] themes. Their themes were updated, though version numbers weren’t bumped. Graph Paper Press, ThemeShift, and ThemeLab have updated the versions of TimThumb within their themes as well. Elegant Themes [...]

Leave a Comment