CVE-2020-8658: 
WordPress vulnerability analysis and mitigation

The Htaccess by BestWebSoft WordPress plugin versions below 1.8.2 were affected by a Cross-Site Request Forgery (CSRF) vulnerability that allowed unauthorized modification of the .htaccess file. The vulnerability was discovered and disclosed in February 2020, identified as CVE-2020-8658. The plugin, which is designed to control access to WordPress websites through .htaccess file management, failed to properly implement CSRF protection mechanisms (WPScan).

The vulnerability stemmed from improper validation of the htccss_nonce_name parameter. While the plugin passed a nonce to WordPress for security verification, it did not correctly validate this token, resulting in a flawed implementation of anti-CSRF protection. This vulnerability received a CVSS score of 8.8 (high severity) (WPScan, GitHub PoC).

An attacker could exploit this vulnerability to make unauthorized modifications to the website's .htaccess file, potentially leading to significant security implications including access control manipulation and website configuration changes (GitHub PoC).

The vulnerability was patched in version 1.8.2 of the Htaccess by BestWebSoft plugin. Users should update to this version or later to protect against this security issue (WordPress Plugin).