Ghost CMS SQL Injection ClickFix Campaign | MSSP Advisory

Threat actors are exploiting CVE-2026-26980, a critical SQL injection vulnerability in Ghost CMS with a CVSS score of 9.4, to inject malicious JavaScript code into over 700 websites. The attack leverages Ghost's Content API to allow unauthenticated attackers to read arbitrary data and execute ClickFix social engineering campaigns. The vulnerability affects Ghost CMS installations that MSSPs may be hosting or managing for clients.

Your own Ghost CMS installations or any client sites running Ghost are exposed to immediate compromise through unauthenticated SQL injection attacks. Client websites built on Ghost CMS are being actively weaponized for social engineering attacks, creating liability exposure when visitors get compromised through sites you manage. Over 700 confirmed compromises means this is not theoretical risk anymore.

📬