Ghost CMS Vulnerability Exploited to Hack Over 700 Websites

CVE-2026-26980, a SQL injection vulnerability in the Ghost CMS, was patched in February and later exploited in mass attacks against unpatched Ghost instances. Unauthenticated attackers used the flaw to extract sensitive data from the Ghost database, including authentication tokens, user credentials, and website content. Threat actors obtained the targeted sites’ Admin API Key and used the Ghost Admin API to modify articles on compromised sites. The attackers injected malicious JavaScript loaders intended for ClickFix-style attacks. Qianxin observed compromised websites starting in early May and identified more than 700 affected sites, including major organizations. Many victims were personal blogs and independent sites, along with technology and specialized content sites.

"The exploited vulnerability is tracked as CVE-2026-26980 and its existence came to light in February when it was patched. Ghost is a widely used open source CMS designed specifically for blogging, newsletters, and publishing, offering built-in tools for memberships, subscriptions, and audience monetization. According to its developer, Ghost is actively used by over 100,000 websites."

"When CVE-2026-26980 was disclosed, SentinelOne warned that the vulnerability, an SQL injection flaw, can be exploited by unauthenticated attackers to extract sensitive data from the Ghost database. The security firm noted that an attacker could obtain authentication tokens, user credentials, and website content."

"Qianxin reported last week that CVE-2026-26980 has been exploited in mass attacks against unpatched Ghost instances. Threat actors leveraged the flaw to obtain the targeted sites' Admin API Key and then used the API to alter articles posted on Ghost-powered sites. Specifically, the attackers injected malicious JavaScript loaders designed for ClickFix attacks."

"Qianxin started seeing compromised websites in early May. The security firm has identified more than 700 websites compromised in the campaign, including ones belonging to major organizations such as DuckDuckGo, Harvard University, and Oxford University. An analysis showed that nearly half of the hacked websites are personal blogs and independent sites, but dozens belong to software development and tech blogs, AI, cryptocurrency, and various other types of entities."

Read at SecurityWeek