{"id":2689,"date":"2026-09-08T14:14:32","date_gmt":"2026-09-08T14:14:32","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/08\/super-forms-luecke-aktiv-ausgenutzt\/"},"modified":"2026-09-08T14:14:32","modified_gmt":"2026-09-08T14:14:32","slug":"super-forms-luecke-aktiv-ausgenutzt","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/09\/08\/super-forms-luecke-aktiv-ausgenutzt\/","title":{"rendered":"Super Forms: Kritische WordPress-L\u00fccke wird massenhaft ausgenutzt"},"content":{"rendered":"<div id=\"netgu-318176178\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>Angreifer nehmen derzeit eine kritische Schwachstelle im weit verbreiteten WordPress-Plugin &bdquo;Super Forms&ldquo; ins Visier. Der US-Sicherheitsdienstleister Wordfence meldete Anfang September 2026 &uuml;ber 250.000 blockierte Angriffsversuche. Die als CVE-2026-14894 gef&uuml;hrte L&uuml;cke mit dem Wert CVSS 9,8 erlaubt die vollst&auml;ndige &Uuml;bernahme verwundbarer Webseiten.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Betroffen ist das Formular-Plugin &bdquo;Super Forms &ndash; Drag &amp; Drop Form Builder&ldquo; des Anbieters WebRehab in allen Versionen bis einschlie&szlig;lich 6.3.313. Der Fehler beruht auf einer fehlenden Pr&uuml;fung von Dateitypen: &Uuml;ber einen ungesch&uuml;tzten AJAX-Endpunkt k&ouml;nnen nicht angemeldete Besucher beliebige Dateien hochladen &ndash; darunter ausf&uuml;hrbare PHP-Skripte.<\/p><div id=\"netgu-3594051165\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-226-watch-face-fuer-wearos-im-google-play-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/deal-3-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U 226 Watch Face f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/star-citizen-twitch-drops-deko-fuer-den-hangar\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/source-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Star Citizen Twitch Drops \u2013 Deko f\u00fcr den Hangar<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/battlefield-6-code-fuer-spielerkartenhintergrund-und-titel\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/battlefield-6-how-to-redeem-codes-asset-code-9-2026_de-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Battlefield 6 \u2013 Code f\u00fcr Spielerkartenhintergrund und Titel<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Wie der Angriff funktioniert<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Nach Analyse von Wordfence missbrauchen die Angreifer die Verarbeitungsroutine &bdquo;submit_form&ldquo;: Sie tarnen PHP-Code als sogenannte Data-URI, umgehen den vorgesehenen Sicherheits-Token &uuml;ber eine separate Funktion und legen so ausf&uuml;hrbare Dateien auf dem Server ab. Beobachtet wurde unter anderem eine schlanke Uploader-Webshell namens &bdquo;Mushr00w_upl.php&ldquo;, &uuml;ber die weiterer Schadcode nachgeladen wird. Ein Gro&szlig;teil der Angriffe stammt laut Wordfence von wenigen IP-Adressen, die jeweils &uuml;ber 80.000 Versuche verursachten.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Betroffene Versionen und Gegenma&szlig;nahmen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Der Hersteller schloss die L&uuml;cke bereits am 8. Juli 2026 mit Version 6.3.314; Wordfence ver&ouml;ffentlichte die Details einen Tag sp&auml;ter. Erste Ausnutzungsversuche registrierten die Analysten ab dem 14. Juli, im September stieg die Angriffswelle noch einmal deutlich an. Administratoren betroffener Seiten sollten dringend handeln:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Umgehend auf Super Forms 6.3.314 oder neuer aktualisieren<\/li><li>Den Server auf unbekannte PHP-Dateien und die Datei &bdquo;Mushr00w_upl.php&ldquo; pr&uuml;fen<\/li><li>Bei Verdacht auf Kompromittierung Zugangsdaten erneuern und Logdateien auswerten<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Quellen:<\/em> <a href=\"https:\/\/patchstack.com\/database\/wordpress\/plugin\/super-forms\/vulnerability\/wordpress-super-forms-drag-drop-form-builder-plugin-6-3-313-unauthenticated-arbitrary-file-upload-vulnerability\" target=\"_blank\" rel=\"noopener\">Patchstack<\/a> &middot; <a href=\"https:\/\/gbhackers.com\/critical-super-forms-wordpress-flaw-actively-exploited\/\" target=\"_blank\" rel=\"noopener\">GBHackers<\/a> &middot; <a href=\"https:\/\/securityonline.info\/super-forms-cve-2026-14894-rce\/\" target=\"_blank\" rel=\"noopener\">Security Online<\/a><\/p>\n<div id=\"netgu-512312144\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Angreifer attackieren massenhaft das WordPress-Plugin Super Forms: \u00dcber eine kritische Upload-L\u00fccke (CVE-2026-14894, CVSS 9,8) lassen sich Webshells einschleusen. Wordfence blockierte \u00fcber 250.000 Versuche \u2013 ein Update steht bereit.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_affilinode_tracking":"","_affilinode_autolink_off":false,"_affilinode_rating":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[109,13],"tags":[],"class_list":["post-2689","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-news"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=2689"}],"version-history":[{"count":0,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2689\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=2689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=2689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=2689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}