Symetrik Domino Consulting

Mark Maunder announced a zero day vulnerability in many WordPress themes yesterday here on his blog.

If you use any third party WordPress themes, you should check your server for the presence of timthumb.php or thumb.php. It is reported that several theme marketplace websites host common legitimate themes that utilize this library.

The fix is to remove any allowed sites from the thumb.php or timthumb.php files as recommended below.

BEFORE:

$allowedSites = array (
	'flickr.com',
	'picasa.com',
	'blogger.com',
	'wordpress.com',
	'img.youtube.com',
	'upload.wikimedia.org',
	'photobucket.com',
);

AFTER:

$allowedSites = array ();

Please read the full technical details at Mark’s blog in the link above.