Thread: Update your timthumb.php! Otherwise, you'll get hacked!

If you have BulletProof Security installed remember to comment out the the .htaccess code that allows thumbnailer scripts to function normally. You can uncomment the .htaccess code after you have patched or replaced your thumbnail script. To comment out the code add a # sign in front of the .htaccess code shown below.

# TimThumb and all other Thumbnailer Images not displaying - Red X instead of Images
# If your theme uses an image thumbnailer script file this fix will work to display images correctly
# as long as thumb is part of the file name like timthumb.php, thumb.php, thumbs.php or phpthumb.php
# RewriteCond %{REQUEST_FILENAME} ^(.*)thumb(.*)$ [NC]
# RewriteRule ^(.*)$ - [S=30]

You should see the notification of this in your wp-admin dashboard, but just to confirm, the v3.1.4 patch has now been released. You can find release notes here.

All customers need to either upgrade to v3.1.4 or at the least, delete or update timthumb.php to the latest version.

Thanks for all of your feedback/input regarding this issue.

Blog post has also been written to address this.

Guys, one of my installs is using the 3.0.5.2, I just deleted timthumbs.php but cant find that Cache folder?

/classipress/includes/timthumb.php *deleted
/classipress/includes/cache/ folder *Not found

Check one level up then. /classipress/cache/ If it's not there, you're fine. TimThumb never created it.

I think I'm fine since I dont see it anywhere, thanks for flagging it David and being proactive about it.

How do I upgrade to 3.1.4? I presumed it would be the same way as installing the original version, however I'm still showing as V3.2.1