WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this exploit was patched.

Yes, I'm aware of the separate issue where TimThumb is also used in plugins -- that's a separate issue. I'm talking about the TimThumb used inside WP in older versions.

share|improve this question
up vote 4 down vote accepted

TimThumb has never been bundled with WordPress, it is/was entirely a third-party theme/plugin issue.

share|improve this answer
Thanks. I guess I got that confused. – Volomike Jun 1 '12 at 16:38

TimThumb doesn't come with WordPress. Are you thinking of the SWFObject XSS exploit? That was patched in 3.3.2. http://codex.wordpress.org/Version_3.3.2

Nearly every WordPress update includes security updates. So if your goal is to make sure the latest security patches are applied, then the answer is: update to the latest version.

share|improve this answer
Good to know about this other exploit. – Volomike Jun 1 '12 at 16:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.