CVE-2025-10745: WordPress Banhammer Bypass Vulnerability

CVE-2025-10745 Overview

CVE-2025-10745 affects the Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress in all versions up to and including 3.4.8. The vulnerability allows unauthenticated attackers to bypass the plugin's request logging and blocking logic. The plugin generates a site-wide secret key deterministically from a constant character set using md5() and base64_encode(), then stores it in the banhammer_secret_key option. Attackers who predict this value can append a banhammer-process_{SECRET} GET parameter to any request. Banhammer aborts its protections when this parameter is present, letting malicious traffic pass unblocked and unlogged.

Critical Impact
Unauthenticated attackers can bypass Banhammer blocking and logging by supplying a predictable secret value in a GET parameter, neutralizing the plugin's protection.

Affected Products

Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress
All versions up to and including 3.4.8
WordPress sites relying on Banhammer for bot and abusive-user blocking

Discovery Timeline

2025-09-26 - CVE-2025-10745 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10745

Vulnerability Analysis

Banhammer implements a per-site bypass token used internally to skip its own request-processing hooks. When any incoming request contains a GET parameter of the form banhammer-process_{SECRET}, the plugin exits early and neither logs nor blocks the request. The security of this mechanism depends entirely on {SECRET} being unpredictable.

The secret is generated in banhammer-core.php and consumed by helper logic in banhammer-functions.php. Because the generation routine draws from a constant character set and applies md5() followed by base64_encode(), the resulting value is deterministic and enumerable by an unauthenticated remote attacker. Once the secret is known or brute-forced, every subsequent request from that attacker can carry the bypass parameter, rendering Banhammer's IP blocking and traffic monitoring ineffective for the attacker's session.

Root Cause

The root cause is use of insufficiently random values [CWE-330]. The banhammer_secret_key option is derived from a fixed input space through predictable primitives (md5() and base64_encode()) rather than a cryptographically secure random generator such as wp_generate_password() or random_bytes(). This makes the token guessable regardless of installation.

Attack Vector

Exploitation is network-based, unauthenticated, and requires no user interaction. An attacker computes or brute-forces the predictable secret, then appends ?banhammer-process_{SECRET}=1 to any HTTP request against the target WordPress site. Banhammer detects the parameter, treats the request as an internal bypass, and skips its blocking and logging paths for that request.

No verified public exploit code is available. Technical implementation details are visible in the plugin source referenced in the WordPress BanHammer Core Code and WordPress BanHammer Functions Code.

Detection Methods for CVE-2025-10745

Indicators of Compromise

Web server access logs containing query string parameters that match the pattern banhammer-process_ followed by a base64-like token.
Requests from previously blocked or blacklisted IP addresses that succeed and produce no corresponding Banhammer log entry.
Sudden gaps in Banhammer's internal event log while unrelated web server logs show continued traffic from the same clients.

Detection Strategies

Grep or query HTTP access logs for the substring banhammer-process_ in request URIs and flag every match for review.
Compare Banhammer's logged request volume against raw web server request volume; large discrepancies suggest bypass activity.
Correlate WordPress authentication failures, XML-RPC hits, and wp-login.php traffic with the presence of the banhammer-process_ parameter.

Monitoring Recommendations

Add a WAF or reverse proxy rule that logs and alerts on any query parameter beginning with banhammer-process_.
Monitor changes to the banhammer_secret_key value in the wp_options table to confirm rotation after patching.
Track outbound blocklist decisions to verify Banhammer is still enforcing rules on high-risk endpoints.

How to Mitigate CVE-2025-10745

Immediate Actions Required

Update the Banhammer plugin to a version later than 3.4.8 that includes the fix referenced in the plugin changesets.
After updating, delete the banhammer_secret_key row from wp_options so the plugin regenerates a fresh, unpredictable value.
Review recent web server logs for prior use of the banhammer-process_ parameter and investigate matching source IPs.

Patch Information

The vendor addressed the issue in the Banhammer plugin trunk. See the fix changesets: Banhammer changeset 3365087 and Banhammer changeset 3365979. Additional analysis is available from the Wordfence Vulnerability Analysis.

Workarounds

Block all requests containing a query parameter that starts with banhammer-process_ at the WAF or web server layer until patching is complete.
Rotate the stored secret manually via WP-CLI: wp option delete banhammer_secret_key and let the updated plugin regenerate it securely.
If patching is not immediately possible, deactivate Banhammer and rely on an alternative blocking control such as fail2ban or a WAF ruleset.

bash

# Example WAF/nginx rule to strip the bypass parameter
if ($args ~* "(^|&)banhammer-process_[^=]+=") {
    return 403;
}

# WP-CLI rotation after upgrading the plugin
wp option delete banhammer_secret_key
wp cache flush