Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this exploit was patched.

Yes, I'm aware of the separate issue where TimThumb is also used in plugins -- that's a separate issue. I'm talking about the TimThumb used inside WP in older versions.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

TimThumb has never been bundled with WordPress, it is/was entirely a third-party theme/plugin issue.

share|improve this answer
    
Thanks. I guess I got that confused. –  Volomike Jun 1 '12 at 16:38

TimThumb doesn't come with WordPress. Are you thinking of the SWFObject XSS exploit? That was patched in 3.3.2. http://codex.wordpress.org/Version_3.3.2

Nearly every WordPress update includes security updates. So if your goal is to make sure the latest security patches are applied, then the answer is: update to the latest version.

share|improve this answer
    
Good to know about this other exploit. –  Volomike Jun 1 '12 at 16:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.