How to Rectify the WordPress Timthumb Hack: A DIY Guide

WordPress is one of the most popular content management systems (CMS) in the world, powering millions of websites. However, its popularity makes it a target for hackers. One common vulnerability that hackers exploit is the TimThumb vulnerability. 

In this post, we will discuss what the TimThumb hack is, how it affects your WordPress site, and provide a step-by-step guide on how to rectify the hack yourself.

Understanding the TimThumb vulnerability in WordPress

TimThumb was a PHP code snippet used in WordPress themes and plugins to dynamically resize images to predefined dimensions to simplify the process of generating thumbnails on the fly. Before WordPress introduced this functionality into Core, TimThumb was an extremely popular script and included with many WordPress themes. Unfortunately, this script became a focal point for a significant cybersecurity concern within the WordPress community.

In 2011, a significant security incident unfolded as hackers exploited a vulnerability in TimThumb, a widely-used script at the time for dynamic image resizing in WordPress. This issue became particularly widespread due to several unique circumstances:

Lack of dynamic image resizing in WordPress

Early versions of WordPress couldn’t resize images dynamically on its own. But when mobile-responsive design gained popularity in the early 2010s, TimThumb came to the rescue. It allowed users to upload an image once and automatically get properly sized images for different screen sizes, even on mobile devices. As a result, TimThumb became a widely used solution in themes.

Prevalence in paid themes

Many premium WordPress themes incorporated TimThumb, bundling the script with their designs. Given that automatic theme updates were not yet widely adopted, users were required to manually update their themes. This posed a challenge as users often neglected updates, leaving vulnerable versions of TimThumb in use for extended periods.

Delayed awareness and remediation

The security issue with TimThumb allowed hackers to upload malicious PHP files, injecting harmful code into websites. Due to the lack of awareness, delayed updates, and the absence of automated security solutions like Shield (which wasn’t available in 2011!), the impact of the hack persisted for years, affecting a substantial number of WordPress sites.

Improved automatic updates

Notably, such a widespread and prolonged vulnerability would be less likely to occur in the present day. Modern WordPress versions benefit from improved automatic update mechanisms. If a security issue were to arise, updates are promptly issued, enabling site owners to quickly secure their websites.

The widespread effect was enhanced by the lack of updates made by website owners. This vulnerability shows us the importance of robust cybersecurity measures for the broader WordPress user base.

Though modern cybersecurity measures have substantially mitigated the TimThumb vulnerability’s impact, it remains an active threat. In fact, at least 56,606 websites are still using TimThumb to this day, including government websites.

💭Did you know? The most exploited plugin on this list, responsible for a huge 36% of WordPress hacks, was Contact Form 7.

The TimThumb script is no longer officially maintained or supported. Yet, it continues to persist on users’ sites, especially if they use outdated plugins and themes. This poses a threat, as TimThumb might unknowingly find its way onto your page, leaving you vulnerable.

Why did this happen in the first place?

Bugs are found in code all the time. When Ben Gillbanks, who initially wrote the TimTumb script, became aware of it, a fix was issued. This is, generally speaking, normal. The issue was that the update didn’t reach end-users because of how developers distributed WordPress themes at the time (as there were no automatic updates), so un-updated sites are still around now.

Ben told us:

When TimThumb was developed, WordPress lacked image thumbnails, prompting its creation to enhance website aesthetics, initially intended for premium WordPress themes. Unexpectedly, its popularity grew as other theme shops adopted the image resizing script.

The first indication that something was wrong was when my own site was defaced. Someone had changed my footer to link somewhere else. Unsure of the cause, I reverted it and ensured everything was up to date. Fortunately, this was before hackers started introducing backdoors, so it didn’t happen again.

A couple of days later, reports emerged that TimThumb was hacked, and my heart sank. I felt super guilty and spent a lot of time over the next few days trying to make it more secure.

Ben hosted TimThumb on Google Code, as GitHub wasn’t an option at the time. TimThumb was open source, and WordPress co-founder Matt Mullenweg got personally involved, introducing Ben and developer Mark Maunder. A fixed version was released, but without automatic updates in WordPress, it didn’t reach end-users with the scale as you’d see now.

Ben shared some insight into the root of the issue:

The vulnerability arose from a few different factors:

1. I had allowed resizing of external images, which meant files from other websites could be loaded.
2. I enabled data caching for those external files without performing any file type checks to ensure they were images, not code.

Detecting the hack: Tools and techniques

The TimThumb exploit from 2011 is still an issue today. As discussed above, over 50,000 sites still use the script. One can assume that a smaller share of these are using the vulnerable version, but with TimThumb no longer maintained and WordPress offering dynamic image resizing, there’s little need for using it in 2024 or beyond.

For those with older websites or looking for absolute certainty about their site’s security, certain steps can be taken to assess and address any lingering use of TimThumb:

1. Access files.

Use your FTP client, Secure Shell, or your hosting provider to access your website’s files.

2. Backup.

Before proceeding, create a backup of your site files to avoid data loss.

3. Search for TimThumb files.

Thoroughly check every file in your root directory. Look specifically for files labelled timthumb.php or thumb.php.

📝Please note: Manual file inspection is time-consuming and liable to human error. We recommend exploring alternative methods, such as using vulnerability scanner plugins.

While there are several plugin options on the market, Shield Security PRO is a great choice due to its extensive suite of customisable features, particularly the Anti-Bot Detection Engine. 

Using Shield Security PRO for early detection and prevention

Using Shield Security PRO is a great way to detect and prevent TimThumb hacks on WordPress sites. It has a vulnerability scanner that identifies known vulnerabilities, including the TimThumb script, allowing users to remove potential threats. The scan is also powered by artificial intelligence and machine learning. Dubbed MAL{ai}, the scanner can identify threats it’s never even seen before with 80-90% accuracy. 

Automatic file scanning is a key feature that compares your website to the default WordPress install to pinpoint files that shouldn’t be present. Shield Security PRO also takes charge of updating themes and plugins while flagging any out-of-date plugins, ensuring your site stays fortified against potential exploits.

The faster vulnerabilities – like the use of the TimThumb script  – are detected, the less opportunity hackers have to exploit and insert malicious code. Shield Security PRO provides a defence mechanism, enhancing your website’s resilience against emerging threats.

Steps to recover your WordPress site post-hack

Discovering a TimThumb vulnerability – or worse, an exploit – can be stressful. To help you with recovery, follow these steps:

Assessing the damage

Compare your site files and databases to the original versions to identify any discrepancies. Use tools like Shield Security PRO’s Malware Scanner to detect malicious code. Look for signs of unauthorised access, unexpected content changes, or alterations to your website’s structure.

Here’s how to scan on Shield Security PRO:

1. Go to your WordPress dashboard and press ShieldPRO.

2. Click Scans.

3. Click the settings icon in the right-hand corner. 

4. Press Run Manual Scan.

5. Press Run Scans Now.

6. From here, you will be notified if anything suspicious is occurring.

Cleaning up the infection

Change all passwords associated with your WordPress site, including admin, FTP, and database passwords. This helps secure your site and prevent further unauthorised access.

Ensure all elements of your WordPress site are up-to-date. This includes the core software, themes, and plugins. Regular updates patch security vulnerabilities, reducing the risk of future attacks.

Remove malicious injections from your databases and files. While technical details can be complex, it’s crucial to ensure your site is entirely free from compromised code. Note that manual cleanup may be risky for non-technical users; consider using specialised tools for a safer and more efficient cleanup. 

For example, Shield Security PRO’s automated scanning and malware removal feature can remove all traces of malicious scripts, including those related to TimThumb vulnerabilities. 

Recovering from backups

If available, restore your WordPress site from a clean backup. It is vital to regularly back up your site as a precautionary measure. There are a variety of WordPress backup plugins available to automate this process.

Communicating the incident

If user data might have been compromised, inform your site users about the breach. We recommend creating a draft communication statement in advance to save time and minimise stress. Include information like the type of attack, compromised data, impact on performance, and assurances about resolving the issue.

🔎 An example email for communicating a breach:

⚠️ You may want to consult legal professionals when drafting and releasing such communications, to ensure compliance with laws like GDPR.

Subject: Important notice regarding recent security incident on [Your Website Name] Dear [Website Users], I hope this message finds you well. We are writing to inform you about a recent security incident that has come to our attention. Your trust in our website’s security is of utmost importance to us, and we want to be transparent about the steps we are taking to address the situation. What happened? Our website recently experienced a security breach, and we believe it is our responsibility to notify you. The breach involved [brief description of the type of attack, e.g., unauthorised access or a specific vulnerability]. We want to assure you that we are taking immediate action to rectify the situation. Was there any compromised data? While we are still conducting a thorough investigation, it is possible that some user data may have been compromised. This may include [specify the type of data that might have been affected, e.g., usernames, email addresses, etc.]. We want to be transparent with you about the extent of the incident and assure you that we are doing everything in our power to safeguard your information. Will this impact performance? We understand the importance of secure data. The breach may have had some impact on the performance of our website. We are actively working to address any performance issues and enhance our security measures to prevent future incidents. We want to assure you that our team is working diligently to resolve the issue. We have taken immediate steps to secure our website and are implementing additional security measures to prevent similar incidents in the future. Your security and privacy are our top priorities. What can you do? As a precautionary measure, we recommend changing your password on our website. Additionally, if you use the same password on other sites, consider updating it there as well – and to avoid using the same password across multiple sites in the future. We also advise monitoring your accounts for any suspicious activity. We are committed to keeping you informed about the progress of our investigation and the actions we are taking. If you have any questions or concerns, please do not hesitate to contact us at [provide a contact email or phone number]. We sincerely apologise for any inconvenience this incident may have caused. Your understanding and cooperation during this time are greatly appreciated. Thank you for being a valued member of our community. Sincerely, [Your Company/Organisation Name][Contact Information]

Assessing and learning

After the recovery, take time to analyse how the hack occurred. Understanding the vulnerability can help you prevent future attacks. 

Securing your WordPress website against TimThumb and other vulnerability attacks

While TimThumb is no longer actively used in WordPress themes or plugins, it could be lingering in out-of-date sections of your site’s code. Regularly updating and removing previous instances of TimThumb in your WordPress site significantly reduces the risk of its exploits. 

Paul Goodchild, creator of Shield Security PRO, says, “If you’re performing regular maintenance on your WordPress sites, the likelihood that you’ll be susceptible to a vulnerability is slim-to-almost-none. You’ll have updated the affected plugin or theme, so you’re already protected.”

Recognising that technology evolves, relying on the right protection is important. A cybersecurity plugin like Shield Security PRO offers security with vulnerability detection, malware scanning, and bad-bot blocking. 

Stay ahead of potential threats by downloading the Shield Security PRO plugin today – your proactive defense against evolving cybersecurity challenges!