CVE-2020-8658

HIGH 8.8CVE-2020-8658 · Published 06/02/2020 · updated 17/06/2026

In short

CVE-2020-8658 is a HIGH (CVSS 8.8) vulnerability affecting htaccess (bestwebsoft).
Chance of exploitation in the next 30 days (EPSS): 9.9%, higher than 95.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
htaccess bestwebsoft	`≤ 1.8.1`	No fix yet

Description

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.

References

V1n1v131r4/Exploiting-WP-Htaccess-by-BestWebSoft-Plugin · Exploit
wordpress.org/plugins/htaccess · Third Party Advisory
wpvulndb.com/vulnerabilities/10060 · Third Party Advisory

More vulnerabilities in htaccess

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free