WordPress News Roundup August 2011: The TimThumb Flaw Hits Premium Themes as WordCamp San Francisco Turns Five

August 2011 opened with one of the most widespread WordPress security problems of the era. On August 1, developer Mark Maunder revealed a serious flaw in TimThumb, a small image-resizing script bundled with a large number of premium themes and plugins. Because the script was copied into so many products, there was no single update that could fix it, and the cleanup took weeks.

The second half of the month belonged to WordCamp San Francisco. The sold-out fifth-anniversary event ran from August 12 to 14, and Matt Mullenweg’s State of the Word address put fresh numbers on WordPress’s growth, including 14.7% of the top million websites.

Mergers, Acquisitions, and Investments

No WordPress acquisitions or funding rounds were announced in August 2011. The month’s business conversation centred on WordCamp San Francisco and on survey data showing how many people now earned a living from WordPress.

WordPress Core Updates

There were no core releases in August. With WordPress 3.2.1 stable, the core team turned to WordPress 3.3, which was heading towards feature freeze in September.

• Survey data released: On August 19 WordPress.org released the raw data from its first user and developer survey so that others could analyse it.
• 3.2 adoption: Mullenweg reported that WordPress 3.2 had reached 500,000 downloads in its first two days.

Other WordPress News

• WordCamp San Francisco (August 12–14): The sold-out conference drew more than 1,000 people and was streamed live to ticket holders around the world.
• State of the Word: In his annual address, Mullenweg said WordPress ran 14.7% of the top million websites, up from 8.5% in the previous measurement, and that 22 of every 100 new active US domains ran WordPress. The plugin directory held about 15,000 plugins with 200 million downloads between them.
• The first WordPress survey: Around 18,000 people responded to the survey, which reported a median hourly rate of $50 for WordPress work.
• Wapuu gets its name: WordPress Japan chose “Wapuu” as the name of its official mascot, a character that would go on to appear in countless local versions around the world.
• Politics on WordPress: Mullenweg noted that six of the ten Republican presidential candidates’ websites ran WordPress, and the other four ran Drupal.

Security Alerts and Plugin Vulnerabilities

TimThumb was the security story of the year so far, and it hit hardest in the premium theme market.

• The flaw: Maunder found that TimThumb could be tricked into fetching a file from a remote site and storing it in its cache directory, where it could then be run as code. He discovered the problem after his own blog began showing ads he had not added. The issue was later tracked as CVE-2011-4106.
• Exploited in the wild: The weakness was used in real attacks, including against the site of TimThumb’s own developer, Ben Gillbanks. Exploit code was published within days, and security firms reported injected code on WordPress sites soon after.
• The fix: Maunder supplied an early patch and a rewritten fork called WordThumb, then worked with Gillbanks to release TimThumb 2.0. Because the script was bundled in so many themes, site owners had to update each affected theme or replace the file by hand.
• Community response: In “The TimThumb Saga”, Mullenweg described how the community came together on a fix, and said VaultPress had patched vulnerable code on more than 700 customer sites.

Industry Trends and Insights

TimThumb exposed a structural weakness in the premium theme market. Many commercial themes bundled the same third-party scripts, often outdated, and had no automatic update system. When one shared script was flawed, thousands of sites were exposed at once, and there was no central way to reach them.

• WordPress as a CMS: The survey showed many people using WordPress for client work, not just personal blogs, and the State of the Word figures confirmed WordPress was taking a growing share of new sites.
• Growth in the top sites: The jump from 8.5% to 14.7% of the top million sites was a sign that larger organisations were adopting WordPress.

Theme of the Month: Hybrid

Justin Tadlock’s Hybrid theme framework was known for clean, standards-based code that followed WordPress best practices. In a month when bundled third-party scripts caused so much trouble, well-built frameworks like Hybrid were a good reminder of why theme code quality mattered.

Plugin of the Month: VaultPress

VaultPress, Automattic’s backup and security service for self-hosted WordPress sites, proved its worth during the TimThumb crisis by patching vulnerable code on more than 700 customer sites. It made a strong case for paid security and backup services as WordPress sites grew more valuable.

Host of the Month: Media Temple

Media Temple was a popular host among designers and agencies in 2011, offering grid and dedicated virtual servers that suited busier WordPress sites. As more client work moved to WordPress, hosts with a reputation for developer-friendly tools found a growing market.

Founder of the Month: Mark Maunder

Mark Maunder, CEO of Feedjit, found and publicised the TimThumb flaw, supplied an early fix and helped release TimThumb 2.0. The experience led him into WordPress security, and he later built the Wordfence security plugin, which launched in 2012.

Looking Ahead to September 2011

WordPress 3.3 was expected to reach feature freeze in September. BuddyPress 1.5 and bbPress 2.0 were both close to release, and the commercial plugin market was looking for its next big category. Site owners with premium themes were advised to keep checking for TimThumb updates.