{"id":1400,"date":"2026-07-25T11:43:58","date_gmt":"2026-07-25T09:43:58","guid":{"rendered":"https:\/\/youaretheinvestigator.com\/?p=1400"},"modified":"2026-07-25T12:00:50","modified_gmt":"2026-07-25T10:00:50","slug":"wordpress-sicherheit","status":"publish","type":"post","link":"https:\/\/youaretheinvestigator.com\/en\/wordpress-sicherheit\/","title":{"rendered":"WordPress-sicherheit\u00a0"},"content":{"rendered":"\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-8c00dfa\" id=\"gspb_row-id-gsbp-8c00dfa\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-9b0ea68\" id=\"gspb_col-id-gsbp-9b0ea68\">\n<h2 id=\"wordpress-wp2shell-kritische-remote-code-execution-schwachstellen\" class=\"wp-block-heading\">WordPress: wp2shell \u2013 Kritische Remote Code Execution Schwachstellen<\/h2>\n\n\n\n<p id=\"gspb_text-id-gsbp-7c79936\" class=\"gspb_text gspb_text-id-gsbp-7c79936 \"><strong>BITS-H Nr. 2026-271984-1132 \u00b7 Version 1.1 \u00b7 20.07.2026<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Das Bundesamt f\u00fcr Sicherheit in der Informationstechnik (BSI) warnt vor zwei Schwachstellen in WordPress, die in Kombination einen nicht-authentifizierten Remote Code Execution (RCE) erm\u00f6glichen. Die Schwachstellenkette wurde als <strong>\u201ewp2shell&#8220;<\/strong> bezeichnet und weist einen CVSS-Score von <strong>9,8 \/ 10<\/strong> auf. Proof-of-Concepts sind \u00f6ffentlich verf\u00fcgbar, erste Ausnutzungen wurden bereits gemeldet. Betroffene Betreiber m\u00fcssen <strong>unverz\u00fcglich<\/strong> handeln.Kritikalit\u00e4t: 3 \/ OrangeTLP: CLEARCVE-2026-60137 \u00b7 CVE-2026-63030<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-f402cea\" id=\"gspb_row-id-gsbp-f402cea\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-d9f993e\" id=\"gspb_col-id-gsbp-d9f993e\">\n<h2 id=\"ubersicht-auf-einen-blick\" class=\"wp-block-heading\">\u00dcbersicht auf einen Blick<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Die nachfolgende Zusammenfassung gibt einen strukturierten \u00dcberblick \u00fcber alle relevanten Eckdaten dieser Sicherheitswarnung \u2013 von den betroffenen Versionen bis zu den behebenden Updates. Alle Informationen stammen aus dem offiziellen BSI-Bericht BITS-H Nr. 2026-271984-1132.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-b06a337\" id=\"gspb_row-id-gsbp-b06a337\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-c53f293\" id=\"gspb_col-id-gsbp-c53f293\">\n<h3 id=\"betroffene-wordpress-versionen\" class=\"wp-block-heading has-large-font-size\">Betroffene WordPress-Versionen<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>6.8.0 \u2013 6.8.5 (nur CVE-2026-60137)<\/li>\n\n\n\n<li>6.9.0 \u2013 6.9.4<\/li>\n\n\n\n<li>7.0.0 \u2013 7.0.1<\/li>\n\n\n\n<li>7.1 beta<\/li>\n<\/ul>\n\n\n\n<h4 id=\"behebende-versionen\" class=\"wp-block-heading\">Behebende Versionen<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress 6.8.6<\/li>\n\n\n\n<li>WordPress 6.9.5<\/li>\n\n\n\n<li>WordPress 7.0.2<\/li>\n\n\n\n<li>WordPress 7.1 beta2<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Versionen \u00e4lter als 6.8 sind <strong>nicht betroffen<\/strong>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-b4cddb6\" id=\"gspb_col-id-gsbp-b4cddb6\">\n<h3 id=\"identifizierte-cves\" class=\"wp-block-heading has-large-font-size\">Identifizierte CVEs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-60137<\/strong> \u2013 CVSS 9,1\/10 (SQL-Injection via author__not_in Parameter in WP_Query)<\/li>\n\n\n\n<li><strong>CVE-2026-63030<\/strong> \u2013 CVSS 7,5\/10 (REST API Schwachstelle)<\/li>\n\n\n\n<li><strong>Kombiniert (wp2shell):<\/strong> CVSS 9,8\/10<\/li>\n<\/ul>\n\n\n\n<h4 id=\"gefahrdungsstatus\" class=\"wp-block-heading\">Gef\u00e4hrdungsstatus<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Aktive Ausnutzung wurde best\u00e4tigt. Proof-of-Concepts sind \u00f6ffentlich verf\u00fcgbar. Die Ausnutzung erfordert <strong>keine Authentifizierung<\/strong>.<\/p>\n\n\n\n<h5 id=\"schutzma\u00dfnahmen\" class=\"wp-block-heading\">Schutzma\u00dfnahmen<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Patch installieren + Workaround (WAF) einrichten<\/p>\n<\/div>\n <\/div><\/div>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-360a4c7\" id=\"gspb_row-id-gsbp-360a4c7\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-757970e\" id=\"gspb_col-id-gsbp-757970e\">\n<h2 id=\"sachverhalt-was-ist-wp2shell\" class=\"wp-block-heading\">Sachverhalt: Was ist wp2shell?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Am 17.07.2026 ver\u00f6ffentlichte WordPress ein Sicherheitsupdate, das zwei Schwachstellen im Kernsystem behebt. In Kombination erm\u00f6glichen diese einem nicht-authentifizierten Angreifer die Ausf\u00fchrung beliebigen Codes auf dem betroffenen Server \u2013 ohne jegliche Anmeldung. Die Schwachstellenkette wurde von Sicherheitsforschern als <strong>\u201ewp2shell&#8220;<\/strong> bezeichnet.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-efc850a\" id=\"gspb_row-id-gsbp-efc850a\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--4 gspb_col-id-gsbp-aee50ef\" id=\"gspb_col-id-gsbp-aee50ef\">\n<h3 id=\"cve-2026-60137-sql-injection\" class=\"wp-block-heading\" style=\"font-size:clamp(16.293px, 1.018rem + ((1vw - 3.2px) * 0.68), 25px);\">CVE-2026-60137 \u2013 SQL-Injection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fehlerhafte Sanitisierung des Parameters <code>author__not_in<\/code> bei WP_Query-Abfragen. Erm\u00f6glicht SQL-Injection-Angriffe, \u00fcber die Angreifer Datenbankinhalte auslesen k\u00f6nnen \u2013 einschlie\u00dflich Passwort-Hashes der Tabelle <code>wp_users<\/code>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--4 gspb_col-id-gsbp-4d63112\" id=\"gspb_col-id-gsbp-4d63112\">\n<h3 id=\"cve-2026-63030-rest-api-schwachstelle\" class=\"wp-block-heading\" style=\"font-size:clamp(16.293px, 1.018rem + ((1vw - 3.2px) * 0.68), 25px);\">CVE-2026-63030 \u2013 REST API Schwachstelle<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Schwachstelle in der WordPress REST API, die in Kombination mit CVE-2026-60137 die vollst\u00e4ndige Remote Code Execution ohne Authentifizierung erm\u00f6glicht. Der Angriff nutzt den Batch-Endpoint <code>\/wp-json\/batch\/v1<\/code>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--4 gspb_col-id-gsbp-e06b586\" id=\"gspb_col-id-gsbp-e06b586\">\n<h3 id=\"entdeckung-durch-ki\" class=\"wp-block-heading\" style=\"font-size:clamp(16.293px, 1.018rem + ((1vw - 3.2px) * 0.68), 25px);\">Entdeckung durch KI<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Das Unternehmen Searchlight Cyber fand die Schwachstelle mithilfe von <strong>OpenAI GPT-5.6 Sol Ultra<\/strong>. Technische Details und die verwendeten KI-Prompts wurden im Blog des Unternehmens ver\u00f6ffentlicht. Ein Proof-of-Concept wurde auf GitHub ver\u00f6ffentlicht.<\/p>\n<\/div>\n <\/div><\/div>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-884fc10\" id=\"gspb_row-id-gsbp-884fc10\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-8a990b1\" id=\"gspb_col-id-gsbp-8a990b1\">\n<h2 id=\"bewertung-bedrohungslage\" class=\"wp-block-heading\">Bewertung &amp; Bedrohungslage<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Das BSI stuft die Schwachstellenkette als <strong>sehr kritisch<\/strong> ein. Die Existenz \u00f6ffentlicher Proof-of-Concepts und die Einfachheit der Ausnutzung ohne Authentifizierung erh\u00f6hen das Risiko massiv. Nur wenige Stunden nach Ver\u00f6ffentlichung der Patches wurden erste PoCs im Internet verbreitet \u2013 ein deutliches Zeichen f\u00fcr die gesunkene \u201eTime-to-Exploit&#8220;.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-64a1c1d\" id=\"gspb_row-id-gsbp-64a1c1d\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-a815df2\" id=\"gspb_col-id-gsbp-a815df2\">\n<div class=\"wp-block-greenshift-blocks-counter gs-counterwrap gspb_counter-id-gsbp-d2d0802\"><div class=\"gs-counterdiv\"><div class=\"gs-counter\" data-start=\"0\" data-end=\"9\" data-duration=\"2\" data-postfix=\".8\">0<\/div><\/div><\/div>\n\n\n\n<h3 id=\"cvss-score\" class=\"wp-block-heading has-large-font-size\">CVSS-Score<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Kombinierter Score der wp2shell-Schwachstellenkette (CVSS 3.1)<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-830630e\" id=\"gspb_col-id-gsbp-830630e\">\n<div class=\"wp-block-greenshift-blocks-counter gs-counterwrap gspb_counter-id-gsbp-4b0c758\"><div class=\"gs-counterdiv\"><div class=\"gs-counter\" data-start=\"0\" data-end=\"0\" data-duration=\"2\">0<\/div><\/div><\/div>\n\n\n\n<h3 id=\"authentifizierung\" class=\"wp-block-heading has-large-font-size\">Authentifizierung<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Keine Anmeldung erforderlich \u2013 Angriffe sind vollst\u00e4ndig anonym m\u00f6glich<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-9c953a8\" id=\"gspb_row-id-gsbp-9c953a8\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-eecb15a\" id=\"gspb_col-id-gsbp-eecb15a\">\n<div class=\"wp-block-greenshift-blocks-counter gs-counterwrap gspb_counter-id-gsbp-36bcf7e\"><div class=\"gs-counterdiv\"><div class=\"gs-counter\" data-start=\"0\" data-end=\"2\" data-duration=\"2\">0<\/div><\/div><\/div>\n\n\n\n<h4 id=\"cves-kombiniert\" class=\"wp-block-heading\">CVEs kombiniert<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Zwei Schwachstellen bilden zusammen die kritische Angriffskette<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-f7babdd\" id=\"gspb_col-id-gsbp-f7babdd\">\n<div class=\"wp-block-greenshift-blocks-counter gs-counterwrap gspb_counter-id-gsbp-6f73fa9\"><div class=\"gs-counterdiv\"><div class=\"gs-counter\" data-start=\"0\" data-end=\"7\" data-duration=\"2\">0<\/div><\/div><\/div>\n\n\n\n<h4 id=\"stunden-bis-poc\" class=\"wp-block-heading\">Stunden bis PoC<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">\u00d6ffentliche Exploits waren bereits Stunden nach Patch-Ver\u00f6ffentlichung verf\u00fcgbar<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background wp-block-paragraph\">WordPress-Betreiber, deren Systeme am Tag der Ver\u00f6ffentlichung (17.07.2026) nicht automatisch aktualisiert wurden, sollten diese umgehend auf eine bereits stattgefundene Kompromittierung pr\u00fcfen.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-71fe4ef\" id=\"gspb_row-id-gsbp-71fe4ef\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-0b0367d\" id=\"gspb_col-id-gsbp-0b0367d\">\n<h2 id=\"betroffene-versionen-im-detail\" class=\"wp-block-heading\">Betroffene Versionen im Detail<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nicht alle WordPress-Versionen sind in gleichem Ma\u00dfe betroffen. Die folgende \u00dcbersicht zeigt, welche Versionen von welcher Schwachstelle betroffen sind und welche Update-Version die L\u00fccke schlie\u00dft. Betreiber sollten zun\u00e4chst pr\u00fcfen, welche Version auf ihrem System l\u00e4uft.<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Version<\/strong><\/td><td><strong>Betroffen von<\/strong><\/td><td><strong>Behebende Version<\/strong><\/td><td><strong>Dringlichkeit<\/strong><\/td><\/tr><tr><td>WordPress 6.8.0 \u2013 6.8.5<\/td><td>CVE-2026-60137 (nur)<\/td><td>6.8.6<\/td><td>Hoch<\/td><\/tr><tr><td>WordPress 6.9.0 \u2013 6.9.4<\/td><td>CVE-2026-60137 + CVE-2026-63030<\/td><td>6.9.5<\/td><td>Kritisch<\/td><\/tr><tr><td>WordPress 7.0.0 \u2013 7.0.1<\/td><td>CVE-2026-60137 + CVE-2026-63030<\/td><td>7.0.2<\/td><td>Kritisch<\/td><\/tr><tr><td>WordPress 7.1 beta<\/td><td>CVE-2026-60137 + CVE-2026-63030<\/td><td>7.1 beta2<\/td><td>Kritisch<\/td><\/tr><tr><td>WordPress &lt; 6.8<\/td><td>Nicht betroffen<\/td><td>\u2013<\/td><td>\u2013<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Der eingeschr\u00e4nkte betroffene Versionsbereich sowie standardm\u00e4\u00dfig aktivierte automatische Updates verringern die Wahrscheinlichkeit einer sehr breiten Angriffswelle. Dennoch k\u00f6nnen verwundbare WordPress-Instanzen kurz- und mittelfristig Ziel automatisierter Angriffe werden.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-3cb9a4b\" id=\"gspb_row-id-gsbp-3cb9a4b\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-d370e71\" id=\"gspb_col-id-gsbp-d370e71\">\n<h2 id=\"schutzma\u00dfnahmen-patchen-workarounds\" class=\"wp-block-heading\">Schutzma\u00dfnahmen: Patchen &amp; Workarounds<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Das BSI empfiehlt, <strong>unverz\u00fcglich<\/strong> eine der abgesicherten Versionen zu installieren. F\u00fcr Betreiber, die automatische Updates deaktiviert haben oder bei denen diese nicht funktionieren (z. B. aufgrund von Dateiberechtigungen), ist eine <strong>manuelle Installation<\/strong> zwingend erforderlich.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-211b18c\" id=\"gspb_row-id-gsbp-211b18c\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-a5ad273\" id=\"gspb_col-id-gsbp-a5ad273\">\n<h3 id=\"patch-installieren\" class=\"wp-block-heading has-large-font-size\">\ud83d\udd27 Patch installieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Automatische Updates aktivieren oder manuell auf Version 6.8.6 \/ 6.9.5 \/ 7.0.2 \/ 7.1 beta2 aktualisieren. Vorher Backup erstellen.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-af69fa4\" id=\"gspb_col-id-gsbp-af69fa4\">\n<h3 id=\"waf-konfigurieren\" class=\"wp-block-heading has-large-font-size\">\ud83d\udee1\ufe0f WAF konfigurieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Web Application Firewall einrichten und Aufrufe auf <code>\/wp-json\/batch\/v1<\/code> sowie Parameter <code>?rest_route=\/batch\/v1<\/code> blockieren.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-0acdf5b\" id=\"gspb_row-id-gsbp-0acdf5b\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-2b912b4\" id=\"gspb_col-id-gsbp-2b912b4\">\n<h4 id=\"rest-api-absichern\" class=\"wp-block-heading\">\ud83d\udd12 REST API absichern<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Plugin zur Blockierung anonymer Zugriffe auf die WordPress REST API installieren, um Angriffe ohne Authentifizierung zu verhindern.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-2bf14cb\" id=\"gspb_col-id-gsbp-2bf14cb\">\n<h4 id=\"verwundbarkeit-prufen\" class=\"wp-block-heading\">\u2705 Verwundbarkeit pr\u00fcfen<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Mit dem Searchlight Cyber Webseiten-Checker unter <strong>wp2shell.com<\/strong> testen, ob die eigene Installation betroffen ist.<\/p>\n<\/div>\n <\/div><\/div>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-1b1ad4c\" id=\"gspb_row-id-gsbp-1b1ad4c\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-295cdaa\" id=\"gspb_col-id-gsbp-295cdaa\">\n<h2 id=\"kompromittierung-prufen\" class=\"wp-block-heading\">Kompromittierung pr\u00fcfen<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Da erste Ausnutzungen bereits gemeldet wurden, sollten alle Betreiber \u2013 insbesondere solche ohne automatische Updates am 17.07.2026 \u2013 ihre Systeme auf Anzeichen einer Kompromittierung untersuchen. Die folgende Checkliste basiert auf aktuellen Empfehlungen von Sicherheitsexperten.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-a003b00\" id=\"gspb_row-id-gsbp-a003b00\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-02eddc4\" id=\"gspb_col-id-gsbp-02eddc4\">\n<h3 id=\"log-analyse-netzwerk\" class=\"wp-block-heading has-large-font-size\">Log-Analyse &amp; Netzwerk<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>POST Requests auf <code>\/wp-json\/batch\/v1<\/code> \u2013 erh\u00f6hte Anfragezahlen sind verd\u00e4chtig<\/li>\n\n\n\n<li>Requests mit Parameter <code>?rest_route=\/batch\/v1<\/code><\/li>\n\n\n\n<li>Login-Versuche mit Benutzernamen <code>wp2_*<\/code> oder <code>w2s_*<\/code><\/li>\n\n\n\n<li>Ungew\u00f6hnliche ausgehende Verbindungen vom Webserver<\/li>\n\n\n\n<li>Ausf\u00fchrung ungew\u00f6hnlicher Prozesse oder Shell-Befehle<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-a268e11\" id=\"gspb_col-id-gsbp-a268e11\">\n<h3 id=\"system-datenbank\" class=\"wp-block-heading has-large-font-size\">System &amp; Datenbank<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Admin-Konten mit Mailadressen <code>@wp2shell.invalid<\/code> oder <code>@wp2shell.shellcode.lol<\/code><\/li>\n\n\n\n<li>Neue oder angepasste Dateien, Plugins und Benutzerkonten \u2013 insbesondere neue Administratoren<\/li>\n\n\n\n<li>Auff\u00e4lligkeiten in <code>oembed_cache<\/code> und <code>customize_changeset<\/code><\/li>\n\n\n\n<li>Unbekannte oder modifizierte WordPress-Kern-Dateien<\/li>\n<\/ul>\n<\/div>\n <\/div><\/div>\n\n\n\n<p class=\"has-light-green-cyan-background-color has-background wp-block-paragraph\">Bei Verdacht auf Kompromittierung: System sofort isolieren, Beweissicherung einleiten, alle aktiven Sessions beenden und alle Nutzerpassw\u00f6rter zur\u00fccksetzen. Passwort-Hashes k\u00f6nnen \u00fcber die SQL-Injection ausgelesen und offline geknackt worden sein.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-28c6d7e\" id=\"gspb_row-id-gsbp-28c6d7e\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-8500f4d\" id=\"gspb_col-id-gsbp-8500f4d\">\n<h2 id=\"passworter-zugangsdaten-andern\" class=\"wp-block-heading\">Passw\u00f6rter &amp; Zugangsdaten \u00e4ndern<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Im Falle einer tats\u00e4chlichen oder vermuteten Kompromittierung m\u00fcssen alle betroffenen Zugangsdaten umgehend ge\u00e4ndert werden. Die SQL-Injection-Schwachstelle erm\u00f6glicht Angreifern den Zugriff auf alle Passwort-Hashes der <code>wp_users<\/code>-Tabelle, die anschlie\u00dfend offline geknackt werden k\u00f6nnen.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-e9cba7b\" id=\"gspb_row-id-gsbp-e9cba7b\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-3b91a61\" id=\"gspb_col-id-gsbp-3b91a61\">\n<h3 id=\"kundenpasswort\" class=\"wp-block-heading has-large-font-size\">\u2192Kundenpasswort<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Das Passwort des WordPress-Benutzerkontos mit Administratorrechten sofort \u00e4ndern. Starkes, eindeutiges Passwort verwenden.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-e702788\" id=\"gspb_col-id-gsbp-e702788\">\n<h3 id=\"e-mail-passworter\" class=\"wp-block-heading has-large-font-size\">\u2192E-Mail-Passw\u00f6rter<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Passw\u00f6rter aller mit der WordPress-Instanz verkn\u00fcpften E-Mail-Konten \u00e4ndern, insbesondere Admin-E-Mail-Adressen.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-e10d9a0\" id=\"gspb_row-id-gsbp-e10d9a0\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-29e77dc\" id=\"gspb_col-id-gsbp-29e77dc\">\n<h4 id=\"plugin-api-zugangsdaten\" class=\"wp-block-heading\" style=\"font-size:clamp(16.293px, 1.018rem + ((1vw - 3.2px) * 0.68), 25px);\">\u2192Plugin- &amp; API-Zugangsdaten<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Alle API-Keys, Token und Zugangsdaten von Plugins und Erweiterungen (z. B. Online-Shop, Payment-Dienste, CDN) zur\u00fccksetzen.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-9548cf9\" id=\"gspb_col-id-gsbp-9548cf9\">\n<h4 id=\"wiederverwendete-passworter\" class=\"wp-block-heading\" style=\"font-size:clamp(16.293px, 1.018rem + ((1vw - 3.2px) * 0.68), 25px);\">\u2192Wiederverwendete Passw\u00f6rter<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Passw\u00f6rter, die auch bei anderen Diensten genutzt wurden, m\u00fcssen ebenfalls bei den jeweiligen Anbietern ge\u00e4ndert werden.<\/p>\n<\/div>\n <\/div><\/div>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-c0e57e7\" id=\"gspb_row-id-gsbp-c0e57e7\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-a662356\" id=\"gspb_col-id-gsbp-a662356\">\n<h2 id=\"empfehlungen-des-bsi\" class=\"wp-block-heading\">Empfehlungen des BSI<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00dcber die unmittelbaren Schutzma\u00dfnahmen hinaus empfiehlt das BSI langfristige Ma\u00dfnahmen, um WordPress-Installationen dauerhaft gegen \u00e4hnliche Angriffe zu h\u00e4rten und die Reaktionsf\u00e4higkeit bei k\u00fcnftigen Sicherheitsvorf\u00e4llen zu verbessern.<\/p>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-72d4197\" id=\"gspb_row-id-gsbp-72d4197\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-b3b33f7\" id=\"gspb_col-id-gsbp-b3b33f7\"><div class=\"wp-block-icon\"><svg aria-hidden=\"true\" focusable=\"false\" style=\"width:36px;\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 24 24\">\n\t<path fill-rule=\"evenodd\" d=\"M18 4H6c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zm-4 14.5H6c-.3 0-.5-.2-.5-.5V6c0-.3.2-.5.5-.5h8v13zm4.5-.5c0 .3-.2.5-.5.5h-2.5v-13H18c.3 0 .5.2.5.5v12z\" \/>\n<\/svg>\n<\/div>\n\n\n<h3 id=\"automatische-updates-aktivieren\" class=\"wp-block-heading\" style=\"font-size:clamp(18.959px, 1.185rem + ((1vw - 3.2px) * 0.863), 30px);\">Automatische Updates aktivieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pr\u00fcfen, ob automatische Updates aktiviert sind und technisch funktionieren. Bei deaktivierten Updates einen Prozess etablieren, der neue Sicherheitsupdates zeitnah einspielt.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-b0484d8\" id=\"gspb_col-id-gsbp-b0484d8\"><div class=\"wp-block-icon\"><svg aria-hidden=\"true\" focusable=\"false\" style=\"width:36px;\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 24 24\">\n\t<path d=\"M12 8c-2.2 0-4 1.8-4 4s1.8 4 4 4 4-1.8 4-4-1.8-4-4-4zm0 6.5c-1.4 0-2.5-1.1-2.5-2.5s1.1-2.5 2.5-2.5 2.5 1.1 2.5 2.5-1.1 2.5-2.5 2.5zM12.8 3h-1.5v3h1.5V3zm-1.6 18h1.5v-3h-1.5v3zm6.8-9.8v1.5h3v-1.5h-3zm-12 0H3v1.5h3v-1.5zm9.7 5.6 2.1 2.1 1.1-1.1-2.1-2.1-1.1 1.1zM8.3 7.2 6.2 5.1 5.1 6.2l2.1 2.1 1.1-1.1zM5.1 17.8l1.1 1.1 2.1-2.1-1.1-1.1-2.1 2.1zM18.9 6.2l-1.1-1.1-2.1 2.1 1.1 1.1 2.1-2.1z\" \/>\n<\/svg>\n<\/div>\n\n\n<h3 id=\"web-application-firewall-einsetzen\" class=\"wp-block-heading\" style=\"font-size:clamp(18.959px, 1.185rem + ((1vw - 3.2px) * 0.863), 30px);\">Web Application Firewall einsetzen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Betreiber wichtiger Webseiten sollten grunds\u00e4tzlich eine WAF einsetzen, um Angriffe kurzfristig abzuwehren \u2013 auch bei noch unbekannten Schwachstellen (Zero-Day).<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-54ff1cd\" id=\"gspb_row-id-gsbp-54ff1cd\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-d1a9aad\" id=\"gspb_col-id-gsbp-d1a9aad\"><div class=\"wp-block-icon\"><svg aria-hidden=\"true\" focusable=\"false\" style=\"width:36px;\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 24 24\">\n\t<path fill-rule=\"evenodd\" d=\"M12 3.176l6.75 3.068v4.574c0 3.9-2.504 7.59-6.035 8.755a2.283 2.283 0 01-1.43 0c-3.53-1.164-6.035-4.856-6.035-8.755V6.244L12 3.176zM6.75 7.21v3.608c0 3.313 2.145 6.388 5.005 7.33.159.053.331.053.49 0 2.86-.942 5.005-4.017 5.005-7.33V7.21L12 4.824 6.75 7.21z\" \/>\n<\/svg>\n<\/div>\n\n\n<h4 id=\"regelma\u00dfige-uberwachung\" class=\"wp-block-heading\">Regelm\u00e4\u00dfige \u00dcberwachung<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Log-Dateien und Systemaktivit\u00e4ten regelm\u00e4\u00dfig auswerten. Auff\u00e4llige Muster wie geh\u00e4ufte API-Aufrufe oder neue Admin-Konten fr\u00fchzeitig erkennen.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-86c982d\" id=\"gspb_col-id-gsbp-86c982d\"><div class=\"wp-block-icon\"><svg aria-hidden=\"true\" focusable=\"false\" style=\"width:36px;\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 24 24\">\n\t<path d=\"M21.3 10.8l-5.6-5.6c-.7-.7-1.8-.7-2.5 0l-5.6 5.6c-.7.7-.7 1.8 0 2.5l5.6 5.6c.3.3.8.5 1.2.5s.9-.2 1.2-.5l5.6-5.6c.8-.7.8-1.9.1-2.5zm-1 1.4l-5.6 5.6c-.1.1-.3.1-.4 0l-5.6-5.6c-.1-.1-.1-.3 0-.4l5.6-5.6s.1-.1.2-.1.1 0 .2.1l5.6 5.6c.1.1.1.3 0 .4zm-16.6-.4L10 5.5l-1-1-6.3 6.3c-.7.7-.7 1.8 0 2.5L9 19.5l1.1-1.1-6.3-6.3c-.2 0-.2-.2-.1-.3z\" \/>\n<\/svg>\n<\/div>\n\n\n<h4 id=\"backups-notfallplan\" class=\"wp-block-heading\">Backups &amp; Notfallplan<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Regelm\u00e4\u00dfige, getrennt gespeicherte Backups sicherstellen und einen Incident-Response-Plan f\u00fcr den Kompromittierungsfall vorhalten.<\/p>\n<\/div>\n <\/div><\/div>\n<\/div>\n <\/div><\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-4ce896b\" id=\"gspb_row-id-gsbp-4ce896b\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--12 gspb_col-id-gsbp-19eb4d3\" id=\"gspb_col-id-gsbp-19eb4d3\">\n<h2 id=\"referenzen-tlp-hinweise\" class=\"wp-block-heading\">Referenzen &amp; TLP-Hinweise<\/h2>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row gspb_row gspb_row-id-gsbp-fa234ba\" id=\"gspb_row-id-gsbp-fa234ba\"><div class=\"gspb_row__content\"> \n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-ff16cd7\" id=\"gspb_col-id-gsbp-ff16cd7\">\n<h3 id=\"quellen-referenzen\" class=\"wp-block-heading has-large-font-size\">Quellen &amp; Referenzen<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>[WP26]<\/strong> WordPress 7.0.2 Release \u2013 <a href=\"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/\" target=\"_blank\" rel=\"noopener\">wordpress.org<\/a><\/li>\n\n\n\n<li><strong>[NVD26a]<\/strong> CVE-2026-63030 \u2013 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-63030\" target=\"_blank\" rel=\"noopener\">nvd.nist.gov<\/a><\/li>\n\n\n\n<li><strong>[NVD26b]<\/strong> CVE-2026-60137 \u2013 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-60137\" target=\"_blank\" rel=\"noopener\">nvd.nist.gov<\/a><\/li>\n\n\n\n<li><strong>[SC26a]<\/strong> Searchlight Cyber wp2shell Research \u2013 <a href=\"https:\/\/slcyber.io\/research-center\/wp2shell-pre-authentication-rce-in-wordpress-core\" target=\"_blank\" rel=\"noopener\">slcyber.io<\/a><\/li>\n\n\n\n<li><strong>[SC26b]<\/strong> wp2shell Vulnerability Checker \u2013 <a href=\"https:\/\/wp2shell.com\/\" target=\"_blank\" rel=\"noopener\">wp2shell.com<\/a><\/li>\n\n\n\n<li><strong>[EYE26]<\/strong> Defender&#8217;s Guide \u2013 <a href=\"https:\/\/research.eye.security\/wp2shell-defenders-guide\/\" target=\"_blank\" rel=\"noopener\">research.eye.security<\/a><\/li>\n\n\n\n<li><strong>[Rapid7]<\/strong> CVE-2026-63030 Analysis \u2013 <a href=\"https:\/\/www.rapid7.com\/blog\/post\/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core\/\" target=\"_blank\" rel=\"noopener\">rapid7.com<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">T\u00e4glich aktuelle Hinweise: <a href=\"https:\/\/www.cert-bund.de\" target=\"_blank\" rel=\"noopener\">cert-bund.de<\/a><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-greenshift-blocks-row-column gspb_row__col--6 gspb_col-id-gsbp-f4d15d3\" id=\"gspb_col-id-gsbp-f4d15d3\">\n<h3 id=\"traffic-light-protocol-tlp\" class=\"wp-block-heading has-large-font-size\">Traffic Light Protocol (TLP)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Dieses Dokument ist als <strong>TLP:CLEAR<\/strong> eingestuft und darf ohne Einschr\u00e4nkungen weitergegeben werden \u2013 abgesehen von urheberrechtlichen Aspekten.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CLEAR:<\/strong> Unbegrenzte Weitergabe<\/li>\n\n\n\n<li><strong>GREEN:<\/strong> Organisations\u00fcbergreifend<\/li>\n\n\n\n<li><strong>AMBER:<\/strong> Eingeschr\u00e4nkt intern<\/li>\n\n\n\n<li><strong>RED:<\/strong> Nur f\u00fcr benannte Empf\u00e4nger<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">TLP-ingestufte Dokumente (au\u00dfer CLEAR) d\u00fcrfen nicht auf Plattformen Dritter (VirusTotal, \u00dcbersetzungsdienste etc.) hochgeladen werden.<\/p>\n<\/div>\n <\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Versionsverlauf: <strong>1.0<\/strong> \u2013 18.07.2026 | <strong>1.1<\/strong> \u2013 20.07.2026 (Update mit PoC-Berichten und erweiterten Kompromittierungsindikatoren)<\/p>\n<\/div>\n <\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":1402,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"#gspb_row-id-gsbp-0acdf5b,#gspb_row-id-gsbp-1b1ad4c,#gspb_row-id-gsbp-211b18c,#gspb_row-id-gsbp-28c6d7e,#gspb_row-id-gsbp-360a4c7,#gspb_row-id-gsbp-3cb9a4b,#gspb_row-id-gsbp-4ce896b,#gspb_row-id-gsbp-54ff1cd,#gspb_row-id-gsbp-64a1c1d,#gspb_row-id-gsbp-71fe4ef,#gspb_row-id-gsbp-72d4197,#gspb_row-id-gsbp-884fc10,#gspb_row-id-gsbp-8c00dfa,#gspb_row-id-gsbp-9c953a8,#gspb_row-id-gsbp-a003b00,#gspb_row-id-gsbp-b06a337,#gspb_row-id-gsbp-c0e57e7,#gspb_row-id-gsbp-e10d9a0,#gspb_row-id-gsbp-e9cba7b,#gspb_row-id-gsbp-efc850a,#gspb_row-id-gsbp-f402cea,#gspb_row-id-gsbp-fa234ba{justify-content:space-between;margin-top:0;margin-bottom:0;display:flex;flex-wrap:wrap}#gspb_row-id-gsbp-8c00dfa>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}div[id^=gspb_col-id]{box-sizing:border-box;position:relative;padding:var(--gs-row-column-padding, 15px min(3vw, 20px))}#gspb_col-id-gsbp-9b0ea68.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-9b0ea68.gspb_row__col--12{width:100%}}.gspb_text-id-gsbp-7c79936,.gspb_text-id-gsbp-7c79936 .gsap-g-line{text-align:center!important}.gspb_text-id-gsbp-7c79936{font-weight:400!important;max-width:480px;border-top-left-radius:10px;border-top-right-radius:10px;border-bottom-right-radius:10px;border-bottom-left-radius:10px;background-color:var(--wp--preset--color--brand-hover, #7AFFCE)}#gspb_row-id-gsbp-f402cea>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-8c00dfa>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-f402cea>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-d9f993e.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-d9f993e.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-b06a337>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-c53f293.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-c53f293.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-c53f293.gspb_row__col--6{background-color:var(--wp--preset--color--brand-hover, #7AFFCE)}#gspb_col-id-gsbp-b4cddb6.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-b4cddb6.gspb_row__col--6{width:100%}}#gspb_row-id-gsbp-360a4c7>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-360a4c7>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-b06a337>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-757970e.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-757970e.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-efc850a>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-aee50ef.gspb_row__col--4{width:33.333333333333336%}@media (max-width:575.98px){#gspb_col-id-gsbp-aee50ef.gspb_row__col--4{width:100%}}#gspb_col-id-gsbp-aee50ef.gspb_row__col--4{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-5px -1px 0 0 var(--wp--preset--color--brand, #33EFAB),0 1px 0 0 var(--wp--preset--color--brand, #33EFAB);border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-aee50ef.gspb_row__col--4,#gspb_col-id-gsbp-aee50ef.gspb_row__col--4>.gspb_backgroundOverlay{border-top-left-radius:11%;border-top-right-radius:11%;border-bottom-right-radius:11%;border-bottom-left-radius:11%}#gspb_col-id-gsbp-4d63112.gspb_row__col--4{width:33.333333333333336%}@media (max-width:575.98px){#gspb_col-id-gsbp-4d63112.gspb_row__col--4{width:100%}}#gspb_col-id-gsbp-4d63112.gspb_row__col--4{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-5px -1px 0 0 var(--wp--preset--color--brand, #33EFAB),0 1px 0 0 var(--wp--preset--color--brand, #33EFAB);border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-2b912b4.gspb_row__col--6>.gspb_backgroundOverlay,#gspb_col-id-gsbp-2bf14cb.gspb_row__col--6>.gspb_backgroundOverlay,#gspb_col-id-gsbp-4d63112.gspb_row__col--4,#gspb_col-id-gsbp-4d63112.gspb_row__col--4>.gspb_backgroundOverlay,#gspb_col-id-gsbp-a5ad273.gspb_row__col--6>.gspb_backgroundOverlay,#gspb_col-id-gsbp-af69fa4.gspb_row__col--6>.gspb_backgroundOverlay,#gspb_col-id-gsbp-e06b586.gspb_row__col--4>.gspb_backgroundOverlay{border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px}#gspb_col-id-gsbp-e06b586.gspb_row__col--4{width:33.333333333333336%}@media (max-width:575.98px){#gspb_col-id-gsbp-e06b586.gspb_row__col--4{width:100%}}#gspb_col-id-gsbp-e06b586.gspb_row__col--4{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-5px -1px 0 0 var(--wp--preset--color--brand, #33EFAB),0 1px 0 0 var(--wp--preset--color--brand, #33EFAB);border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px;border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-884fc10>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-884fc10>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-efc850a>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-8a990b1.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-8a990b1.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-64a1c1d>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-a815df2.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-a815df2.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-a815df2.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-1px -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff)),0 -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff))}.gspb_counter-id-gsbp-d2d0802,.gspb_counter-id-gsbp-d2d0802 .gs-counterwrap{display:flex;align-items:center}.gspb_counter-id-gsbp-d2d0802 .gs-counterdiv{display:flex;text-align:center;flex-direction:column;justify-content:center;align-items:center;border-radius:5px}.gspb_counter-id-gsbp-d2d0802 .gs-counter{font-size:80px;line-height:80px;font-weight:400;margin-bottom:5px}.gspb_counter-id-gsbp-d2d0802 .gs-counterlabel{font-size:16px;line-height:16px}.gspb_counter-id-gsbp-d2d0802 .gs-counterdiv{min-width:200px}#gspb_col-id-gsbp-830630e.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-830630e.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-830630e.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-1px -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff)),0 -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff))}.gspb_counter-id-gsbp-4b0c758,.gspb_counter-id-gsbp-4b0c758 .gs-counterwrap{display:flex;align-items:center}.gspb_counter-id-gsbp-4b0c758 .gs-counterdiv{display:flex;text-align:center;flex-direction:column;justify-content:center;align-items:center;border-radius:5px}.gspb_counter-id-gsbp-4b0c758 .gs-counter{font-size:80px;line-height:80px;font-weight:400;margin-bottom:5px}.gspb_counter-id-gsbp-4b0c758 .gs-counterlabel{font-size:16px;line-height:16px}.gspb_counter-id-gsbp-4b0c758 .gs-counterdiv{min-width:200px}#gspb_row-id-gsbp-9c953a8>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-64a1c1d>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-9c953a8>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-eecb15a.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-eecb15a.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-eecb15a.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-1px -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff)),0 -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff))}.gspb_counter-id-gsbp-36bcf7e,.gspb_counter-id-gsbp-36bcf7e .gs-counterwrap{display:flex;align-items:center}.gspb_counter-id-gsbp-36bcf7e .gs-counterdiv{display:flex;text-align:center;flex-direction:column;justify-content:center;align-items:center;border-radius:5px}.gspb_counter-id-gsbp-36bcf7e .gs-counter{font-size:80px;line-height:80px;font-weight:400;margin-bottom:5px}.gspb_counter-id-gsbp-36bcf7e .gs-counterlabel{font-size:16px;line-height:16px}.gspb_counter-id-gsbp-36bcf7e .gs-counterdiv{min-width:200px}#gspb_col-id-gsbp-f7babdd.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-f7babdd.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-f7babdd.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03),-1px -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff)),0 -1px 0 0 var(--wp--preset--color--palette-color-10, var(--theme-palette-color-10, #ffffff))}.gspb_counter-id-gsbp-6f73fa9,.gspb_counter-id-gsbp-6f73fa9 .gs-counterwrap{display:flex;align-items:center}.gspb_counter-id-gsbp-6f73fa9 .gs-counterdiv{display:flex;text-align:center;flex-direction:column;justify-content:center;align-items:center;border-radius:5px}.gspb_counter-id-gsbp-6f73fa9 .gs-counter{font-size:80px;line-height:80px;font-weight:400;margin-bottom:5px}.gspb_counter-id-gsbp-6f73fa9 .gs-counterlabel{font-size:16px;line-height:16px}.gspb_counter-id-gsbp-6f73fa9 .gs-counterdiv{min-width:200px}#gspb_row-id-gsbp-71fe4ef>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}.gspb_row{position:relative}#gspb_col-id-gsbp-0b0367d.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-0b0367d.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-3cb9a4b>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-3cb9a4b>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-71fe4ef>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-d370e71.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-d370e71.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-211b18c>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-a5ad273.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-a5ad273.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-a5ad273.gspb_row__col--6{box-shadow:0 2px 4px 0 rgba(0,0,0,.07);border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px;border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-af69fa4.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-af69fa4.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-af69fa4.gspb_row__col--6{box-shadow:0 2px 4px 0 rgba(0,0,0,.07);border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px;border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-0acdf5b>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-0acdf5b>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-211b18c>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-2b912b4.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-2b912b4.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-2b912b4.gspb_row__col--6{box-shadow:0 2px 4px 0 rgba(0,0,0,.07);border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px;border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-2bf14cb.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-2bf14cb.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-2bf14cb.gspb_row__col--6{box-shadow:0 2px 4px 0 rgba(0,0,0,.07);border-top-left-radius:11px;border-top-right-radius:11px;border-bottom-right-radius:11px;border-bottom-left-radius:11px;border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-1b1ad4c>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-295cdaa.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-295cdaa.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-a003b00>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-1b1ad4c>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-a003b00>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-02eddc4.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-02eddc4.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-02eddc4.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-a268e11.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-a268e11.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-a268e11.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-28c6d7e>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-8500f4d.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-8500f4d.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-e9cba7b>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-28c6d7e>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-e9cba7b>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-3b91a61.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-3b91a61.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-3b91a61.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-e702788.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-e702788.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-e702788.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-e10d9a0>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-29e77dc.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-29e77dc.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-29e77dc.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_col-id-gsbp-9548cf9.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-9548cf9.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-9548cf9.gspb_row__col--6{border-style:solid;border-width:1px;border-color:var(--wp--preset--color--border, #00000012)}#gspb_row-id-gsbp-c0e57e7>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-c0e57e7>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-e10d9a0>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-a662356.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-a662356.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-72d4197>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-b3b33f7.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-b3b33f7.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-b3b33f7.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03)}#gspb_col-id-gsbp-b0484d8.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-b0484d8.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-b0484d8.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03)}#gspb_row-id-gsbp-54ff1cd>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-54ff1cd>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-72d4197>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-d1a9aad.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-d1a9aad.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-d1a9aad.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03)}#gspb_col-id-gsbp-86c982d.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-86c982d.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-86c982d.gspb_row__col--6{box-shadow:0 5px 20px 0 rgba(0,0,0,.03)}#gspb_row-id-gsbp-4ce896b>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}#gspb_col-id-gsbp-19eb4d3.gspb_row__col--12{width:100%}@media (max-width:575.98px){#gspb_col-id-gsbp-19eb4d3.gspb_row__col--12{width:100%}}#gspb_row-id-gsbp-fa234ba>.gspb_row__content{display:flex;justify-content:space-between;margin:0 auto;width:100%;flex-wrap:wrap}body.gspb-bodyfront #gspb_row-id-gsbp-4ce896b>.gspb_row__content,body.gspb-bodyfront #gspb_row-id-gsbp-fa234ba>.gspb_row__content{width:var(--theme-container-width, 1200px);max-width:var(--theme-normal-container-max-width, 1200px)}#gspb_col-id-gsbp-ff16cd7.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-ff16cd7.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-f4d15d3.gspb_row__col--6{width:50%}@media (max-width:575.98px){#gspb_col-id-gsbp-f4d15d3.gspb_row__col--6{width:100%}}#gspb_col-id-gsbp-f4d15d3.gspb_row__col--6{background-color:var(--wp--preset--color--brand-hover, #7AFFCE)}","footnotes":""},"categories":[4],"tags":[],"class_list":["post-1400","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-betrugsschutz"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/posts\/1400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/comments?post=1400"}],"version-history":[{"count":5,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/posts\/1400\/revisions"}],"predecessor-version":[{"id":1407,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/posts\/1400\/revisions\/1407"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/media\/1402"}],"wp:attachment":[{"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/media?parent=1400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/categories?post=1400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/youaretheinvestigator.com\/en\/wp-json\/wp\/v2\/tags?post=1400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}