CVE-2025-10745

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the banhammer_secret_key option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named banhammer-process_{SECRET} where {SECRET} is the predictable value, thereby causing Banhammer to abort its protections for that request.

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the banhammer_secret_key option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named banhammer-process_{SECRET} where {SECRET} is the predictable value, thereby causing Banhammer to abort its protections for that request.

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the banhammer_secret_key option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named banhammer-process_{SECRET} where {SECRET} is the predictable value, thereby causing Banhammer to abort its protections for that request.

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the banhammer_secret_key option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named banhammer-process_{SECRET} where {SECRET} is the predictable value, thereby causing Banhammer to abort its protections for that request.