Yesterday, Mark Maunder over at markmaunder.com managed to track down the source of a pretty clever hack on his site, where the hacker gained access through the massively popular TimThumb image thumbnail creation library. You can read his full post on the matter here:
Zero Day Vulnerability in Many WordPress Themes
He’s made an interesting post detailing the work he did to catch the hack – If you have the time, give it a read.
More importantly – this hack has the potential to affect hundreds of thousands of WordPress installs. Unfortunately, because the timthumb library is generally included in themes (both free and premium), it’s not going to be very easy to get patched. Premium theme sellers will no doubt release updates and notify their users, but free theme users are less likely to have such good luck. As such, it’s going to be a good idea to check your site out for this vulnerability, and fix it as soon as possible.
(Note – Subscribers to Locker have had their sites scanned for this vulnerability, and are being automatically notified if they’ve got a problem right now.)
Nearly anyone using the timthumb library, who downloaded it before yesterday (8/1/11) is likely to be vulnerable. How do you know if you’re using timthumb? The easiest way is probably to check out your theme folders for a file called timthumb.php, using FTP, or your host’s file browser. If you’re using a host with cPanel (like Hostgator), it’s very easy – just load up the file manager, and then use the “Find” box in the upper right corner to search for timthumb.php. No results? Chances are good that you’re safe.
Make sure you check every folder in your theme – it’s likely that if your theme has a lot of included files, this file would be in a directory inside your main theme folder.
Fortunately, thanks to the hard work of Mark in finding this and bringing it to light, Ben (the creator of TimThumb), and a few other folks, there is a more secure version of the script now available for download here:
http://timthumb.googlecode.com/svn/trunk/timthumb.php
To secure your site, save that file (File->Save Page As in most browsers) to your computer, and then upload it to your site via FTP, replacing every instance of timthumb.php with the new version you just downloaded. If that’s beyond you, or you want to be absolutely sure that you’ve closed the hole up, send me an email at peter@codegarage.com, or hit me on twitter @peterbutler, and I’ll help get you straightened out.
Good luck!
Thanks Peter…this works just perfectly for us without any further work required–just upload and replace. Unfortunately, we’ve got about 65 sites to do…grrrr
Do we need to also patch inactive themes that we may have on our site? I have 2-5 old themes per site. Do I need to update timThumb on all those also?
Once infected by this vulnerability can you provide any insight on how to clean-up and stop further attacks?
I have updated the timthumb version on one of my client sites, however the malware is still being reported on my site.
After performing a scan on http://sitecheck.sucuri.net/scanner/ I was notified of two infected files which were:
/wp-includes/js/jquery/jquery.js
/wp-includes/js/l10n.js
and I have also replaced these with what I believe to be clean versions.
Some other reports that I have seen talk about a file uploaded to the /wp-content directory called upd.php however this file does not exist on my server?
Any help you have on this problem would be most appreciated.
Hey Bro
Its only 2-3 months I got my site up and I only got one website yet.
But still when I come to know about this vulnerability then I scanned my wordpress through the plugin and their are 19 files in my cache folder which are vulnerable. No other file, only 19 files are their where small images or re-sized images automatically gets stored.
So should I just delete those files or is their anything else I need to do ?
I got This error after scan (below)
“Suspicious Files
These files likely indicate that hackers have already compromised your system. They should be deleted. Please note: No files listed here does NOT guarantee you haven’t already been compromised, but files listed here almost certainly means you have.
If your server has been compromised, your best bet is to hire a professional to clean your site up (Click here for more info – even if all you want is a little advice).”
What should I do ?
Waiting for your reply.
Thanks
it didn’t work for me 
August 3, 2011
Thank you Peter…VERY helpful!! : )