CVE-2025-10745: Specialk Banhammer – Monitor Site Traffic, Block Bad Users And Bots

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using md5() and base64_encode() and then stored in the `banhammer_secret_key` option. This makes it possible for unauthenticated attackers to bypass the plugin’s logging and blocking by appending a GET parameter named `banhammer-process_{SECRET}` where `{SECRET}` is the predictable value, thereby causing Banhammer to abort its protections for that request.

Affected products

• Specialk Banhammer – Monitor Site Traffic, Block Bad Users And Bots: up to and including 3.4.8

Published 2025-09-26. Last modified 2026-06-17.