Attackers are exploiting CVE-2026-26980 to inject malicious JavaScript code for ClickFix campaigns targeting website visitors.
- Critical SQL injection vulnerability CVE-2026-26980 in Ghost CMS is being actively exploited
- Over 700 websites compromised to serve malicious JavaScript for ClickFix attacks
- Vulnerability allows unauthenticated attackers to read arbitrary database information
Cybercriminals are actively exploiting a critical SQL injection vulnerability in Ghost CMS to compromise websites and launch ClickFix attacks against visitors. Research from QiAnXin XLab reveals that more than 700 websites have been hijacked through exploitation of CVE-2026-26980.
The vulnerability affects Ghost’s Content API and carries a CVSS score of 9.4, indicating critical severity. The flaw allows unauthenticated attackers to perform SQL injection attacks and read arbitrary data from affected databases.
Attackers are leveraging this access to inject malicious JavaScript code into compromised Ghost CMS installations. The injected code is designed to facilitate ClickFix attacks, a social engineering technique that tricks users into clicking malicious links or downloading harmful content.
ClickFix campaigns typically present fake error messages or security warnings to website visitors, prompting them to take actions that compromise their systems. By compromising legitimate websites through the Ghost CMS vulnerability, attackers can reach a broader audience and increase the credibility of their malicious campaigns.
The widespread exploitation of CVE-2026-26980 demonstrates how quickly threat actors can weaponise newly disclosed vulnerabilities. The vulnerability’s location in the Content API makes it particularly attractive to attackers, as it provides a pathway to compromise websites without requiring authentication.
Why It Matters
This incident highlights the operational risks posed by content management system vulnerabilities in organisational web infrastructure. CISOs should be aware that compromised websites can damage brand reputation and potentially expose visitors to malware, creating liability concerns that may require board-level reporting.
The rapid exploitation timeline also underscores the importance of vulnerability management programmes that can quickly identify and remediate critical flaws in web-facing applications.
What To Do Now
- Audit all Ghost CMS installations within your organisation and apply available patches for CVE-2026-26980
- Review web application vulnerability scanning procedures to ensure critical CMS vulnerabilities are detected quickly
- Monitor websites for unauthorised JavaScript injection and implement content security policies to reduce malicious code execution risks
