Reply To: Vulnerable version of timthumb in connections.php?

@ Michael

Definitely a false positive. That plugin is actually flagging the word timthumb in the credit comments in the file header. Saying fix, will severely break Connections to the point your site will crash. The only way to recover would be to delete Connections and reinstall.

Of note, Connections never included the insecure version and the hole that was exploited in old version was always deactivated in the TimThumb config for Connections. That hole was, by default, TimThumb permitted select sites as source URL/s for images. I have it configured to only images on the same site, no externals allowed.

Hope that helps.