Accessing
http://www.example.com/wordpress/wp-content/ themes/vulnerable-theme/thumb.php?src=flickr.com.example.org/payload.php
One could trivially make a list of signatures for vulnerable themes (for example, all the ones I paid for from a certain prominent Wordpress themes company), and then exploit any website whose main page matched a signature. Alternatively, you could just speculatively hit a few hundred URLs on every domain you found.
$fileDetails = pathinfo($src);
$ext = strtolower($fileDetails['extension']);Even if you don't have such vulnerabilities you probably don't want people to be able to upload images to your server. They could easily send you over quota on shared hosting and use your bandwidth for serving their own images (including child porn).
This still allows the attacker to host images on your site though.
See also my comments last week about the (lack of) wisdom in embedding a ruby shell in a web application.
While I much prefer going through SHH to manage my sites, there are likely 10x as many WP sites run by people who can only FTP. There isn't really an ideal solution in this situation (apart from education) so I think allowing easy updates by having weaker security may be best. Maybe there is a better solution that still works for FTP. If so, file a ticket.
The WordPress Codex is a wiki and it looks like the docs on security could do with some improvements - sign up and help out.
This is turning out to be a rather big hole.
I have invested a bit of time installing and tuning mod_security. I'd love to know how it'd have faired against this attack, probably it wouldn't have stopped the upload, but it might have stopped a lot of payload/control commands from working.
Wordpress could theoretically intercept calls to PHP files below its own root, but that would be a breaking change for a LOT of code and sites.
Realistically the best thing that could happen is that plugins like WP-Security Scan could check for timbthumb.php's presence and warn you.
https://www.owasp.org/images/d/db/Wordpress-security-ext.pdf
if (preg_match($site, $url_info['host']) == true) {
function clean_source ( $src ) {
// remove http/ https/ ftp
$src = preg_replace("/^((ht|f)tp(s|):\/\/)/i", "", $src);
// remove domain name from the source url
$host = $_SERVER["HTTP_HOST"];
$src = str_replace($host, "", $src);
$host = str_replace("www.", "", $host);
$src = str_replace($host, "", $src);
That's not an option on a surprising number of web hosts offering PHP hosting. You'd have to find the file using FTP instead.
mv PATH/xmlrpc.php PATH/xmlrpc.php.nope
chmod 000 PATH/xmlrpc.php.nope
I bought my theme from Theme Forest and it has this vulnerability. If you have a theme that you've purchased and contains this file, it would be helpful to post this on the theme's support forum.
php resize crop and cache source.