|
Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this exploit was patched. Yes, I'm aware of the separate issue where TimThumb is also used in plugins -- that's a separate issue. I'm talking about the TimThumb used inside WP in older versions. |
|||
|
|
|
TimThumb has never been bundled with WordPress, it is/was entirely a third-party theme/plugin issue. |
|||
|
|
|
TimThumb doesn't come with WordPress. Are you thinking of the SWFObject XSS exploit? That was patched in 3.3.2. http://codex.wordpress.org/Version_3.3.2 Nearly every WordPress update includes security updates. So if your goal is to make sure the latest security patches are applied, then the answer is: update to the latest version. |
|||
|
|
