Ghost CMS SQL Injection Fueling ClickFix Campaigns

In May 2026, a large-scale campaign exploited a SQL injection vulnerability in Ghost CMS, tracked as CVE-2026-26980. This flaw affects Ghost versions 3.24.0 through 6.19.0 and resides in the unauthenticated Content API's slug filter ordering logic. By abusing this vulnerability, attackers can read arbitrary database data, including administrative API keys.

Once obtained, these Admin API keys allow attackers to tamper with website content at scale. The campaign, reported by QiAnXin XLab and others, involved poisoning over 700 domains with malicious JavaScript loaders. These scripts present visitors with social engineering pages, such as 'ClickFix' or 'FakeCaptcha,' which attempt to trick users into executing malicious commands directly on their local machines.

The impact is severe because it transforms a trusted web presence into a malware delivery vector. Affected sectors include higher education, fintech, AI/SaaS, and media. Organizations must prioritize upgrading to Ghost 6.19.1, rotating all Admin API keys, and conducting a thorough audit of published content to remove injected scripts.