CVE-2025-10745
Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass
The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named `banhammer-process_{SECRET}` where `{SECRET}` is the predictable value, thereby causing Banhammer to abort its protections for that request.
| CWE | CWE-330 |
| Vendor | specialk |
| Product | banhammer – monitor site traffic, block bad users and bots |
| Published | Sep 26, 2025 |
| Last Updated | Apr 8, 2026 |
Get instant alerts for specialk banhammer – monitor site traffic, block bad users and bots
Be the first to know when new medium vulnerabilities affecting specialk banhammer – monitor site traffic, block bad users and bots are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N