Threat actors are actively exploiting a critical SQL injection vulnerability in Ghost CMS, tracked as CVE-2026-26980, to compromise more than 700 websites across sectors including universities, blockchain, artificial intelligence, software-as-a-service, security research, media, and financial technology. The vulnerability exists within Ghost’s Content API and allows unauthenticated attackers to retrieve arbitrary data from the backend database, including the site’s Admin API key.
Once obtained, attackers leverage the Admin API to inject malicious JavaScript loaders into published articles, facilitating large-scale ClickFix malware campaigns. The vulnerability was patched in Ghost version 6.19.1 in February 2026. Originally discovered by Anthropic using its Claude AI system, active exploitation was first observed on May 7, 2026, and continues to expand. Organizations operating unpatched Ghost CMS instances should immediately upgrade to the latest supported version.
CVE-2026-26980 is a critical SQL injection vulnerability affecting Ghost CMS’s publicly accessible Content API. Because the API can be accessed without authentication, attackers can submit specially crafted SQL queries that execute directly against the backend database and return arbitrary data.
The most severe outcome is the ability to extract the site's Admin API key without requiring valid credentials. Once the Admin API key is obtained, attackers gain full administrative access through the Ghost Admin API, enabling them to create, modify, or delete content across the entire website. This effectively results in complete compromise of the Ghost CMS instance through a single unauthenticated request.
The vulnerability was discovered by Anthropic using its Claude artificial intelligence system.
Following compromise, attackers inject malicious JavaScript into website articles using the Admin API. The injected code acts as a two-stage loader that retrieves additional payloads from external infrastructure, including clo4shara[.]xyz. The payload utilizes Adspect, a commercial traffic cloaking service that filters security scanners and automated crawlers while selectively serving malicious content to genuine users.
Victims are redirected to fake CAPTCHA verification pages displayed through embedded iframes. These pages initiate ClickFix attacks by instructing users to copy and paste Base64-encoded commands into the Windows Run dialog. The commands download ZIP archives containing batch scripts that subsequently retrieve and execute malicious DLL or JavaScript payloads through rundll32.exe, ultimately installing a persistent backdoor application on the victim's system.
The details and technicalities of the exploitation campaign are discussed further.
Exploitation Demonstration:
Ease of Exploitation:
The vulnerability requires no authentication, no prior access, and no elevated privileges. Any attacker capable of reaching a vulnerable Ghost CMS instance can retrieve the Admin API key through a single unauthenticated request.
Once administrative credentials are obtained, attackers can leverage Ghost’s fully documented and legitimate Admin API to perform large-scale content manipulation without requiring advanced exploit development or specialized malware deployment frameworks.
The combination of unauthenticated access, direct credential exposure, and access to an authorized management interface significantly lowers the technical barrier to exploitation. The compromise of more than 700 websites within weeks of public disclosure demonstrates that automated exploitation is already occurring at scale.
Conclusion:
CVE-2026-26980 represents an actively exploited and highly impactful threat to organizations operating Ghost CMS versions earlier than 6.19.1. The attack chain is fully automated, requires no authentication, and has already resulted in the compromise of hundreds of trusted websites worldwide, including institutions in education, research, media, and financial technology sectors.
The use of commercial cloaking services to evade detection, combined with modular malware delivery mechanisms, indicates a sophisticated and persistent threat actor capable of conducting large-scale malicious campaigns.
Organizations should immediately upgrade to Ghost CMS version 6.19.1 or later, rotate exposed credentials, audit website content for unauthorized modifications, and assess whether visitors may have been exposed to malicious payloads. Failure to remediate may result in continued website compromise, malware distribution, and significant reputational damage.
Successful exploitation of CVE-2026-26980 grants attackers full administrative control over affected Ghost CMS instances and enables the large-scale injection of malicious JavaScript across published website content.
Visitors accessing compromised websites may be redirected into ClickFix malware campaigns that install persistent Electron-based backdoors on Windows systems. These backdoors establish ongoing communication with remote command-and-control infrastructure, typically polling every 30 seconds, and provide attackers with capabilities including arbitrary command execution, file theft, persistence, and lateral movement.
For website operators, the consequences extend beyond platform compromise. Organizations may unknowingly become malware distribution points, exposing customers, partners, students, researchers, or employees to downstream compromise. This can result in significant reputational damage, operational disruption, regulatory scrutiny, and loss of stakeholder trust.
For UAE and MENA organizations, successful compromise may trigger obligations under applicable data protection regulations, including UAE Personal Data Protection Law (PDPL) requirements where personal information is exposed or distributed through compromised platforms. Organizations should assess potential notification obligations and incident response requirements where visitor compromise is suspected.
https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html
