{"id":254449,"date":"2026-05-24T10:12:00","date_gmt":"2026-05-24T14:12:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/24\/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign\/"},"modified":"2026-05-24T21:00:12","modified_gmt":"2026-05-25T01:00:12","slug":"ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/24\/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign\/","title":{"rendered":"Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign"},"content":{"rendered":"

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign\/<\/a><\/p>\n

Publish Date: 2026-05-24 10:12:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows.<\/p>\n

The campaign was discovered by XLab threat intelligence researchers at Chinese cybersecurity company Qianxin, who confirmed impact on more than 700 domains, including university portals, AI\/SaaS companies, media outlets, fintech firms, security sites, and personal blogs.<\/p>\n

According to the researchers, threat actors planted malicious code on the websites of Harvard University, Oxford University, Auburn University, and DuckDuckGo.<\/p>\n

\"CompromisedCompromised sites<\/strong>
Source: XLab<\/p>\n

\u00a0<\/p>\n

CVE-2026-26980 impacts Ghost 3.24.0 through 6.19.0, and allows unauthenticated attackers to read arbitrary data from the website database, including the admin API keys.<\/p>\n

This key gives management access to users, articles, and themes, and can be used to modify article pages.<\/p>\n

Although the fix for the issue was released on February 19 in Ghost CMS version 6.19.1, many sites failed to install the security update.<\/p>\n

SentinelOne published on February 27 details about CVE-2026-26980 being exploited in attacks and how incidents can be detected. The researchers observed at least two distinct activity clusters targeting vulnerable Ghost sites, sometimes re-infecting the same domains with different scripts after cleanup, or one cleaning the script of the other to inject its own.<\/p>\n

\"TimelineTimeline of the attacks<\/strong>
Source: XLab<\/p>\n

Attack chain<\/h3>\n

The attacks that XLab observed begin by exploiting CVE-2026-26980 to steal the admin API keys, and then use the elevated rights to inject malicious JavaScript into articles.<\/p>\n

The JavaScript code is a lightweight loader that fetches second-stage code from the attacker\u2019s infrastructure, which is essentially a cloaking script that fingerprints visitors to determine whether they qualify as targets.<\/p>\n

Visitors passing the verification are served a fake Cloudflare prompt loaded via an iframe on top of the…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign https:\/\/www.bleepingcomputer.com\/news\/security\/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign\/ Publish Date: 2026-05-24 10:12:00…<\/p>\n","protected":false},"author":1,"featured_media":254450,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/05\/22\/GhostCMS.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,27],"class_list":["post-254449","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/254449"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=254449"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/254449\/revisions"}],"predecessor-version":[{"id":254451,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/254449\/revisions\/254451"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/254450"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=254449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=254449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=254449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}