It’s no secret that users love WordPress for easily creating and sharing content. There are a lot of great sites that do a multitude of extremely useful things at the UW, and we only see growth and adoption increasing as we look into the future. However, as with any other content management system, WordPress sees its share of security vulnerabilities. While the core is soild and the WordPress team has done an excellent job locking it down, 3rd party theme and plugin developers can oftn write insecure code that leads to zero-day exploits that can do some very nasty things to your site.
Good File Gone Bad: TimThumb.php
While it isn’t included in the stock WordPress experience, many themes and plugins use a file called “timthumb.php” to work with uploaded images. Unfortunately, the timthumb.php code was highly insecure and an attacker could upload a specially crafted “image” file that would allow them to upload and run arbitrary scripts onto the web server.
Find Out More
Check to See if Your Site is Infected
The links above offer greater insights into this issue and checking to see if your site is impacted. If you discover some unknown code, odd behaiviour, or otherwise signs that may indicate a possible site, please contact email@example.com