CVE-2025-10745 describes a blocking bypass vulnerability in the Banhammer – Monitor Site Traffic, Block Bad Users and Bots WordPress plugin. The vulnerability arises from the use of an insufficiently random secret key generated deterministically using md5() and base64_encode() from a constant character set. This predictable secret key is stored in the plugin's `banhammer_secret_key` option. An attacker can exploit this by appending a GET parameter named `banhammer-process_{SECRET}` with the known secret value, causing the plugin to abort its logging and blocking mechanisms for that request, effectively bypassing protections without authentication.

An attacker can bypass the Banhammer plugin's blocking and logging protections by exploiting the predictable secret key, allowing malicious requests to evade detection and blocking. This could reduce the effectiveness of the plugin in preventing bad users and bots from accessing the site. There is no direct confidentiality or availability impact reported. The CVSS score of 5.3 reflects a medium severity with no required privileges or user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider disabling the plugin or applying custom mitigations to prevent the bypass, such as monitoring for suspicious GET parameters matching the bypass pattern. Avoid relying solely on this plugin for blocking critical threats.