A critical SQL injection flaw in Ghost CMS is being mass-exploited to hijack more than 700 legitimate websites — including universities and well-known tech brands — and turn them into delivery platforms for ClickFix malware aimed at their own readers.

The vulnerability itself is not new. It was patched in February 2026. What changed is the campaign: attackers are now weaponizing the sites that never updated, using the trust those domains carry to push malware that visitors install on themselves. The flaw is the entry point. The reputation of the compromised site is the payload’s best friend.

The most important signal here is not the CVE. It is the shift in delivery. The reader is no longer being phished by an obvious bad actor. The reader is being attacked by a site they already trusted.

The Threat at a Glance

Why This Vulnerability Matters

Most web vulnerabilities are dangerous because of what they do to the server. This one is dangerous because of what it lets an attacker do to everyone who visits the server afterward.

CVE-2026-26980 is a SQL injection flaw in Ghost’s Content API, rated CVSS 9.4, that allows an unauthenticated attacker to read arbitrary data from the database. On its own, arbitrary database read is serious. What makes this specific flaw severe is what sits in that database: the site’s Admin API key.

Once an attacker has the Admin API key, they no longer need to break anything else. They can invoke Ghost’s Admin API directly and modify published articles in bulk. The compromise stops being a data-exposure problem and becomes a content-control problem. The attacker can rewrite what the site publishes.

That is the pivot worth holding onto. A read-only injection bug became a write-anything-to-the-page capability, because the one thing the attacker could read was the credential that unlocks everything else.

One detail is worth noting for context: the underlying vulnerability was discovered by Anthropic using Claude, then patched by Ghost in February. The disclosure-to-exploitation gap here was not measured in days. The patch had been available for roughly three months before this campaign scaled. The exposure is not a failure of disclosure. It is a failure of patching.

How the Attack Chain Works

The campaign chains a server-side flaw to a client-side social-engineering attack. Each stage hands off to the next.

The attacker first exploits CVE-2026-26980 to extract the Admin API key from an unpatched Ghost instance. Using that key, they call the Admin API to inject a malicious JavaScript loader at the bottom of the site’s articles, in bulk. At this point the site looks normal to its operator. The poisoned code lives inside legitimate published content.

The injected loader is a two-stage retriever. Rather than carrying the payload itself, it pulls the main payload at runtime from an external domain. This design lets the operators swap payloads at will while leaving the same loader sitting quietly across hundreds of compromised sites.

The external script is not served to everyone. It runs through a commercial cloaking service that fingerprints the visitor’s browser and decides what to return. Security scanners and crawlers are shown a harmless page. Only visitors judged to be real targets are advanced to the next stage — which is why automated scanning can miss this entirely.

Targeted visitors are then served a fake CAPTCHA verification page inside an iframe. This is the ClickFix step. Instead of a normal checkbox, the page instructs the visitor to copy a command into a Windows system dialog to “prove they are human.” That action quietly retrieves and runs an attacker-supplied script, while a decoy page is opened to keep the user unaware.

The final payload has varied across iterations of the campaign, but the end state is consistent: a Windows executable on the victim’s machine. In observed cases this has included a signed remote-access client and an application built from a modified open-source desktop client, configured for persistence and remote control.

When the Trusted Site Is the Attack Surface

ClickFix attacks live or die on credibility. The technique asks the victim to do something they should never do — run an attacker’s command on their own machine — and dress it up as a routine verification step. The single biggest factor in whether that works is where the request appears to come from.

That is what this campaign optimizes. By compromising universities, AI and SaaS companies, security research sites, media outlets, and fintech firms, the operators are not just gaining reach. They are borrowing each site’s reputation. A visitor who would dismiss a “verify you are human” prompt on a sketchy domain is far more likely to follow it on a site they arrived at deliberately and already trust.

The cloaking layer compounds the problem for defenders. Because the malicious payload is only served to selected visitors and hidden from scanners, a site owner running automated checks may see nothing wrong. The poisoned JavaScript can sit inside published articles, served to real readers, while crawler-based monitoring reports the site as clean.

The result is a distribution model where every compromised publisher becomes a malware node for its entire audience, and where neither the visitor nor the site operator is positioned to easily notice. The visitor trusts the site. The site cannot see the payload. The attacker sits in the gap.

What Defenders Should Do Now

This is two different problems for two different audiences, and both need action.

For anyone running Ghost CMS, treat this as an active-compromise scenario, not a pending patch. Upgrade to 6.19.1 or later immediately if you have not already. Critically, patching alone is not sufficient: if the instance was exposed while unpatched, the Admin API key should be assumed stolen. Rotate all credentials, including the Admin API key, then audit content and access logs for unauthorized API activity and injected scripts at the bottom of articles. Because the flaw allowed silent key theft months before this campaign began, the relevant question is not “am I patched now” but “was my key extractable at any point since February.”

Operators should also review the contamination window. The campaign’s compromised sites have been observed since early May, with detection from May 7. Visitors who accessed an affected site during the period it was poisoned may have been served the ClickFix lure and should be notified of potential compromise.

For defenders protecting endpoints rather than running Ghost, the relevant control is the ClickFix step itself. The attack cannot complete unless a user is tricked into running a command outside the browser. Monitor for and alert on script interpreters spawned from user-driven clipboard activity, scripting tools reaching out to freshly seen domains, and unexpected executables landing on user workstations shortly after web browsing. User awareness matters here in a way it usually does not: staff should be told plainly that no legitimate site verification ever requires running a command on their machine.

The Bigger Lesson

It is easy to read this as a Ghost CMS story. It is more accurately a trust-supply-chain story.

The pattern ByteVanguard has tracked across edge appliances, control planes, and identity infrastructure holds here too: attackers prioritize whatever sits closest to trust. In this campaign, the trusted asset is not a privileged process or an authentication token. It is the reputation of a publisher. The flaw merely unlocks the door; the reason the attack works is that the visitor never doubts the room they walked into.

Two failures combine to make this possible. The first is the patch gap — a critical flaw fixed in February, still exposed on hundreds of sites in May. The second is the human gap that ClickFix exploits, now amplified by familiar branding. Neither is novel on its own. Together they turn ordinary websites into the most convincing malware delivery network an attacker could ask for.

References & Original Sources

• Ghost Security Advisory: GHSA-w52v-v783-gw97 (CVE-2026-26980)
• QiAnXin XLab: Ghost CMS mass compromise fueling ClickFix attacks
• The Hacker News: Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites
• SecurityWeek: Ghost CMS Vulnerability Exploited to Hack Over 700 Websites
• TechRadar Pro: Ghost CMS flaw hijacked to target hundreds of websites with ClickFix attacks
• Malwarebytes: 700+ education and tech websites hijacked in huge ClickFix malware campaign

ByteVanguard tracks CISA KEV activity, exploited vulnerabilities, AI security, and enterprise threat intelligence. Subscribe for weekly briefings.