Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Threat actors exploit CVE-2026-26980, a critical SQL injection in Ghost CMS Content API, to read arbitrary database data without authentication. The flaw, fixed in Ghost version 6.19.1, can be used to obtain a site's Admin API key without permission. With the stolen key, attackers can call the Ghost Admin API to tamper with articles in bulk. Malicious JavaScript loaders are injected at the bottom of pages to retrieve payloads at runtime and support fake CAPTCHA attacks. The activity is described as large-scale poisoning, with multiple threat clusters targeting sites rapidly. The campaign has compromised more than 700 websites across multiple industries, potentially increasing ClickFix attack success rates.

"Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks. According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the database. The security flaw was addressed in February 2026 in version 6.19.1."

"What makes the vulnerability severe is that it allows an attacker to gain access to a site's admin API key without permission, granting them the ability to poison the site by injecting malicious code. The admin API key can be used to invoke the admin API and can directly modify articles published on the content management system. The threat actor leveraged the security flaw to "obtain the target site's Admin API Key without authorization, and then used the Ghost Admin API to tamper with articles in bulk, injecting malicious JavaScript loaders at the bottom of the pages to assist fake CAPTCHA attacks," XLab said."

"The activity has been described by the Chinese security vendor as a "large-scale poisoning" campaign weaponizing the Ghost CMS flaw. At least two different threat clusters are assessed to be behind the campaign, in some cases implanting certain sites with malicious code within a single day. It was first detected on May 7, 2026. In all, the campaign has compromised more than 700 websites, spanning universities, blockchain, artificial intelligence, software-as-a-service (SaaS), security research, media, and financial technology sectors."

"The injected JavaScript code at the bottom of an article functions as a two-stage loader that's responsible for retrieving the main payload at runtime from an ext"

Read at The Hacker News