Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass
Strategic Overview
- Status
- Patched in 3.4.9
- Affected Plugin
- Banhammer – Monitor Site Traffic, Block Bad Users and Bots
- Affected Version
<= 3.4.8- CVSS
- 5.3Medium
- Weakness type
- CWE-330 · Use of Insufficiently Random Values
- CVE
CVE-2025-10745
At a glance
CVE-2025-10745 is a medium-severity Use of Insufficiently Random Values vulnerability in the Banhammer WordPress plugin, affecting versions <= 3.4.8. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.4.9; sites on affected versions should update now. Disclosed September 2025, reported by Jonas Benjamin Friedli.
Vulnerability Overview
The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named `banhammer-process_{SECRET}` where `{SECRET}` is the predictable value, thereby causing Banhammer to abort its protections for that request.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Remediation
Update to version 3.4.9, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Banhammer 3.4.9 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C