Hackers attack zero-day flaw in WordPress themes

A security hole in a widely used image resizing utility has exposed millions of WordPress blogs to malicious hacker attacks.

Malicious hackers have pounced on a zero-day vulnerability in a widely used image-resizing utility that ships with themes for the popular WordPress blogging platform.

The timthumb utility, used to handle cropping, zooming and resizing web images, is used by millions of blogs running certain themes and because it writes files into a directory during the image-resizing process, it can be used to launch web attacks.

Feedjit CEO Mark Maunder discovered the vulnerability during an audit of a successful attack on his own blog.

follow Ryan Naraine on twitter




Turns out the theme I’m using, Memoir, which I bought for $30 from ElegantThemes.com uses a library called timthumb.php. timthumb.php uses a cache directory which lives under wp-content and it writes to that directory when it fetches an image and resizes it.


Maunder has submitted a patch for the open-source utility and has posted detailed instructions for WordPress users to check and mitigate the vulnerability.