Published
2025-09-26
·
Updated
2025-09-26
·
CVE-2025-10745
5.3
Medium
| Base vector | Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
**Name of the Vulnerable Software and Affected Versions**
Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress versions through 3.4.8
**Description**
The Banhammer plugin for WordPress is susceptible to a blocking bypass. This occurs because a site-wide “secret key” is predictably generated using md5() and base64 encode() from a constant character set and stored in the `banhammer secret key` option. Unauthenticated attackers can bypass the plugin’s logging and blocking mechanisms by appending a GET parameter named `banhammer-process {SECRET}` where `{SECRET}` is the predictable key value. This causes Banhammer to disable its protections for that specific request.
**Recommendations**
Update to a version later than 3.4.8.
Fix
Use of Insufficiently Random Values