WordPress Vulnerability in “TimThumb” theme script

websense offers this graph of the recent “timthumb” security issue. I have certainly had my hands full tracking this bugger down and cleaning it up. This is a good argument for managed WordPress hosting where an expert keeps an eye on these issues for you.

via: Vulnerability in TimThumb WordPress Plugins – The Effects – Security Labs.

Read more about how to fix this issue at wpcandy. I found that many themes use the filename “thumb.php” so watch for that.

Note: you MUST delete timthumb or upgrade timthumb ASAP. AND you should still scan your files AND change your passwords. More helpful links:

• TimThumb 0-day vulnerability
• Affected themes
• SuperDomain information
• SuperDomain followup
• You can scan your site, free, at http://sitecheck.sucuri.net/scanner (It is safe to check, but I think this will only check if  your site has been hacked – not if this vulnerability is there)