WPThumb
Avoid: vulnerability published 19 Jun 2025 still has no fix after 14 days.
Capped at 39 while a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 0 |
| Security | 35 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 19 Jun 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.3 Jul 2025Evidence
- CriticalMNT-1No release in 153 months (last release 1 Apr 2014). Plan a replacement if the plugin is important to your site.1 Apr 2015Evidence
- WarningMNT-2Tested up to WordPress 3.7.41, 34 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
Commit history is collected for plugins with 1,000+ installs or on a watchlist. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 13 years ago
- Releases, 24 months
- 0
- Tested up to
- 3.7 vs 7.1
- Requires PHP
- not stated supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 0 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 1 Apr 2014. Tested up to 3.7, 34 major versions behind WordPress 7.1.
Support
Support history appears after our first snapshots of the forum counts.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 19 Jun 2025 | WPThumb <= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery | 6.4 | <= 0.10 | No fix | n/a |
Source: Wordfence Intelligence.
Reputation
Lifetime rating 5.0 from 3 ratings. Quarterly trends appear as new reviews arrive.
| 5 star | 3 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Momentum
800+ active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
Facts
| Version | 0.10 |
|---|---|
| Author | Joe Hoyle |
| Added | 11 Nov 2011 |
| Last updated | 1 Apr 2014 |
| Active installs | 800+ |
| Requires WordPress | 3.5 |
| Tested up to | 3.7.41 |
| Requires PHP | not stated |
| Category | Performance & Optimization > Image Optimization & Compression |
| Tags | crop, image, resize, phpthumb, thumbnail |
Other plugins by this author: WP REST API - OAuth 1.0a Server, WordPress REST API - Authentication Broker, FrontKit for WordPress
Questions
Is WPThumb still maintained?
WPThumb was last updated on 1 Apr 2014. Its Canary status is Avoid.
Is WPThumb safe?
WPThumb has 1 published vulnerability with no patched version. Its Canary status is Avoid.
Who owns WPThumb?
The wordpress.org author is Joe Hoyle. We have recorded no ownership change.
What can I use instead of WPThumb?
Plugins in the same category with a higher Canary Score: Cimo - Free Instant Image Optimizer & WebP Converter, reSmush.it : The original free image compressor and optimizer plugin, Resize Image After Upload, ImageMagick Engine, Image Prioritizer.