Regardless of when you last updated your theme, I would strongly suggest that everyone update their themes to the latest version and insure that the timthumb.php file and your /cache folder have been removed. To update your theme and remove the file, simply delete your current theme via the Appearances > Themes section of the WordPress Dashboard. Then you can re-download the theme from the members area and re-upload it normally:

https://www.elegantthemes.com/members-area/documentation.html#installdashboard

The latest theme versions require that your thumbnail images be hosted on the same domain name where WordPress is installed. If you were previously using timthumb.php to allow external image source by editing the file’s $allowedSites array, then these thumbnails will no longer function.

There is also the option of updating timthumb.php to the latest version if you still want to use it. You can download the latest source code for the script here. Or, you can considering editing your current timthumb.php file to remove the external source functionality that is the cause of the vulnerability. You can learn more in this post by VaultPress. However, I would recommend downloading the new version of the theme instead.

Before updating the theme, make sure that you are using the latest version of WordPress. I would also disable all of your plugins temporarily before doing any update to insure that no compatibility issues exist. Remember to always keep WordPress, your Themes and your Plugins up-to-date to help protect yourself against any vulnerabilities.

This security flaw also applies to all of your inactive themes as well. If you have any theme, even if it is inactive, that contains the timthumb.php file then you are potentially at risk. I would suggest deleting all of the themes that you are not using in addition to updating the ones that you are. This file is very common throughout all WordPress themes, not just Elegant Themes. 

If you haven’t noticed, theme production has been a bit slower over the past month. This is because we have been hard at work performing some collection-wide back-end updates. While these behind-the-scenes source code updates may go unnoticed to the average user, I can assure you that many improvements have been made

Bug Fixes

We have fixed a few minor bugs that were causing frequent headaches in the forums.

Thumbnail Improvements - No More Timthumb

Until now, you had the choice of using the “Thumbnail custom field” or WordPress’s native “Featured Image” method for creating thumbnails for your posts. The thumbnail custom field used a third party script, Timthumb.php, to re-szie and crop your images. While timthumb is a great script, it was not as intuitive and could sometimes cause performance issues. At the same time, the “Featured Image” method only allows you to input a single photo for each post, making it impossible to use this feature for posts with multiple thumbnails. We have now re-written the “Thumbnail custom field” method to use WordPress’s internal image-resizing script to crop the thumbnails, instead of using Timthumb. This should result in a minor performance increase, file size decrease, and it also means you no longer have to adjust the permissions of the cache/ directory (making it more secure as well).

Performance Enhancements

We have made some changes to ePanel that should increase performance in wp-admin. Using ePanel should feel a bit snappier now, especially when saving your settings. Function updates across all theme files and the previously-mentioned thumbnail changes should also increase performance on the front-end.

Security Audit

We have performed a fresh audit on all of our theme files to continue to insure that they are as secure as possible. This includes insuring proper data validation on input/output, use of nonces on admin pages, MySQL injection protection, replacing depreciated WordPress functions, etc. While I am talking about security, let me remind you that it is important to always keep WordPress and your third party Plugins/Themes up-to-date. It’s also a good idea to keep frequent backups just in case. Automattic has released a new backup service that looks pretty cool if you are interested: http://vaultpress.com/

Update Notifications and Changelogs

Speaking of updates, we have taken some steps to make update notifications more accessible. Whenever a theme is updated, you will now receive an update notification in the WordPress Dashboard. A changelog will also display in the Appearances > Themes section of wp-admin when your theme is not up-to-date. Furthermore, these changelogs have been integrated into the Elegant Themes member’s area for easy viewing.

Portfolio Variations

Portfolio Small – The small gallery displayed your thumbnails in columns of 5, allowing you to add dozens of projects to a single page without creating too much clutter.

Portfolio Medium – The medium gallery displays your projects in columns of 3. This style is ideal if you plan to include titles/descriptions in the gallery (which can be turned on and off).

Portfolio Large – The large gallery displays your photos in columns of two. If you only have a few projects to display, the large gallery is probably your best choice.

Portrait Orientation – The Portfolio Page Template has an option to auto-detect the aspect ratio of your photos, and display them accordingly in either Landscape or Portfolio mode. In this example, you can see that portrait photos were used.

Portfolio With Sidebar – You can also choose whether or not you want to display a sidebar in the gallery. Each variation comes with full width/sidebar options.

Portfolio Without Text – Finally, you can choose whether or not you want to display titles/descriptions. These can be turned off interdependently. In this example you can see that both titles/descriptions have been removed.

Portfolio Features

Improved Lightbox - We have updated all themes with a new lightbox script that allows for more advanced features.

Video Support – Unlike our Gallery Page Template, the Portfolio template supports video integration. By simply adding the link to your video in a custom field, the video will display in the lightbox when clicked.

Custom Icon Lists

We have added a few different list styles that can be applied to any list you make. Simply wrap the list in the [ custom_list] shortcode and choose your icon type (green check mark, red x or gray dot). The list will then be formatted accordingly.

Corporate Pricing Tables

The new pricing tables offer you a beautiful way to showcase your various products and how their features and prices compare with each other. What before would have been a complicated HTML endeavor can now be created quickly and easily using the [ pricing_table] shortcode. Using this shortcode you can list features differentiated with the green check or red x, adjust the table titles and descriptions, change the price and adjust the button text and URL. You can also choose between two pricing table styles (big and small).

Testimonials

The new testimonials shortcode gives you an easy way to show your visitors what your customers think about your product. Gaining the trust of your viewers is important, and now it’s easier than ever to create styled testimonial blurbs on any of your posts or pages.

Dropcaps

Dropcaps are a simply typographic technique that will spice up and give hierarchy to your post copy. Simply wrap a letter at the beginning of your paragraph with the drop cap shortcode and it will become nested within the body content. You can then apply any style that you want to the letter, allowing you to change its size, color and font face.

Quotes

One thing that our themes have been lacking are well-formatted quotes. This problem has now been solved with new quote shortcode which comes in two different styles.

Contact Form

One of the most common elements of a website is a contact form. Instead of seeking third party plugins to create a contact form, now you can apply our Contact Form page template to any page for an integrated solution to receiving messages from your visitors. The form also includes a captcha for reducing spam.

Image Gallery

Creating a beautiful and functional image gallery has never been easier. Now you can apply our image gallery template to your page and choose to populate the page with image posts from any combination of categories. This template is enhanced with compelling animations and lightbox effects.

Sitemap

A sitemap is a great way to give your visitors a visual map of your entire website. Applying the sitemap template to your page will create an organized display of all of your categories, pages, tags and authors.

Advanced Search

The advanced search feature expands on the basic WordPress search function, allowing users to search particular categories, time frames, as well as post types (pages vs posts).

Member Login

Instead of sending your visitors to the standard, unbranded /wp-login form, now you can embed your own login form into any of your pages. This creates a much more cohesive solution for logging your readers or authors into the WordPress dashboard.

Full Width

The full width page template removes the sidebar from your page and allows your content to extend the entire width of the theme. This is an extremely useful tool, and opens your pages up to countless new content options. Furthermore, this full width template can be applied in conjunction with our other templates, allowing you to have, for example, a full-width image gallery.

Blog Feed

Now you can create a standard blog feed, populated with categories of your choosing, no matter what theme you are using. This will display a list of recent posts in a Blog-Style format, independent of the standard post and category format of the theme. This allows you to create a separate “Blog” section of your website without having to actually create a Blog category and add posts to it.

I hope everyone enjoys the page templates that we have made so far. I feel like this is a great start, but also hope to add many more templates in the future. Please leave a comment and let us know what you think!