CVE-2026-26980 in Ghost CMS Under Mass Attack: How a Compromised Corporate Blog Becomes a ClickFix Trap for Its Own Readers

Your corporate blog’s content may have become a weapon against your own readers without your knowledge. Researchers at QiAnXin XLab have confirmed an active mass exploitation campaign targeting CVE-2026-26980, a critical SQL injection (CVSS 9.4) in Ghost CMS’s Content API that allows an unauthenticated attacker to read arbitrary data from the site’s database. The injected malicious JavaScript triggers a ClickFix attack against blog visitors: it displays a fake error message instructing the reader to execute a command in their terminal, infecting their device with malware. The Hacker News is amplifying it today. Among the sites compromised in the campaign are properties belonging to Harvard, Oxford and DuckDuckGo. The patch is available in Ghost 5.120.1.

‍

What do we know about CVE-2026-26980 and the active Ghost CMS campaign?

Facts documented by QiAnXin XLab and The Hacker News:

• Vulnerability: SQL injection (CVE-2026-26980) in Ghost CMS’s Content API. Allows an unauthenticated attacker to send manipulated SQL queries to the blog’s public API and read arbitrary data from the underlying database.
• CVSS 9.4 — Critical: no authentication required, remotely exploitable, high confidentiality impact. One of the highest scores recorded for a publishing CMS.
• Affected Ghost version: versions prior to Ghost 5.120.1. Ghost’s Content API is public by design — it is what readers and frontends use to access content — making it an attack surface directly exposed to the internet without any prior authentication.
• Active mass campaign: QiAnXin XLab documents an ongoing campaign exploiting CVE-2026-26980 at scale to inject malicious JavaScript into the frontend of compromised Ghost CMS sites.
• High-profile compromised sites: among the sites affected in the campaign are properties belonging to Harvard University, Oxford University and DuckDuckGo. Their presence confirms the campaign operates at scale without discriminating by victim size or profile.
• The payload triggers ClickFix: the injected JavaScript shows blog visitors a fake error message — typically a technical problem notice with instructions to “fix it” — that actually asks them to copy and execute a command in their terminal. If the victim follows the instructions, their device is compromised with malware.
• Patch available: Ghost Foundation released the fix in Ghost 5.120.1. The update is immediate via Ghost CLI or the Ghost(Pro) admin panel.

‍

Why Ghost CMS is a high-value target for attackers

Ghost is not the most widely known CMS for the general public, but it is the de facto standard for corporate blogs, B2B newsletters and content platforms at tech companies, digital media outlets and academic institutions. That combination makes it a particularly attractive target:

1. A corporate blog’s audience is the company’s business audience. Readers of a cybersecurity firm’s blog, a consultancy, a law firm or a SaaS platform are typically executives, IT managers or potential clients with access to corporate systems. Infecting those readers via ClickFix carries a much higher impact multiplier than a consumer site.
2. Ghost’s Content API is public by design. Unlike CMSs with separate protected admin APIs, Ghost’s Content API is directly exposed on the blog domain so readers and frontends can consume content. CVE-2026-26980 abuses that legitimate exposure.
3. Ghost(Pro) vs self-hosted: different urgency levels. Ghost(Pro) users (the managed platform by Ghost Foundation) receive automatic updates. Self-hosted Ghost users — the majority of corporate installations — are exposed until they manually apply the patch.
4. The ClickFix vector turns readers into victims without full server compromise. The SQL injection allows reading database data, but the largest-scale damage in this campaign is the JavaScript injection: the blog server does not need to be fully compromised for thousands of readers to be attacked.

‍

How the attack works: from SQL injection to ClickFix against readers

The CVE-2026-26980 attack chain follows two distinct vectors that can operate in parallel:

Vector 1 — Data exfiltration via SQL injection:

1. The attacker identifies exposed Ghost CMS sites (Ghost’s Content API responds at /ghost/api/content/ on any standard installation).
2. Sends manipulated queries to the Content API exploiting CVE-2026-26980: filter parameters that are not properly sanitised are passed directly to the SQL engine.
3. Reads arbitrary data from the database: unpublished draft content, subscriber data, integration tokens, internal configurations and potentially credentials stored in the database.

Vector 2 — Malicious JavaScript injection and ClickFix attack on readers:

1. With database access via SQL injection, the attacker modifies post content or active theme templates to include a malicious JavaScript script that runs in every visitor’s browser.
2. The injected JavaScript shows visitors a fake error screen: typically a “page rendering problem” or “browser verification error” message simulating a legitimate OS or browser warning.
3. The fake message includes instructions to “resolve the issue”: copy a command to the clipboard and paste it into the terminal (PowerShell on Windows, Terminal on macOS). The command downloads and executes malware on the reader’s device.
4. Readers who follow the instructions — especially in corporate environments where error warnings create urgency to “fix it quickly” — compromise their own devices without any file download or browser exploit detectable by traditional antivirus tools.

‍

Key lessons and mitigation checklist for Ghost CMS administrators

Immediate action — Update Ghost:

• Ghost self-hosted: update to Ghost 5.120.1 or higher via Ghost CLI: ghost update. Verify the installed version with ghost ls or in the admin panel at Settings → About.
• Ghost(Pro): updates are applied automatically. Verify the active version in the Ghost(Pro) dashboard. If not on 5.120.1+, contact Ghost Foundation support.

Check whether the site has been compromised:

• Review the source code of public blog pages for unauthorised JavaScript scripts, especially in the <head> or at the end of the <body>.
• Audit the database change history: check for posts or templates recently modified without editorial team authorisation.
• Review web server logs (Nginx/Apache) for unusual requests to /ghost/api/content/ with long or suspicious filter parameters.
• Check for recently mass-added subscribers or modified integration data.

If the site has been compromised:

• Temporarily take the site offline until malicious content is cleaned.
• Remove all unauthorised JavaScript from post content and theme templates.
• Rotate all Ghost integration tokens (Settings → Integrations) and connected service API keys.
• Change the administrator password and all users with Ghost panel access.
• Notify subscribers and recent visitors about the possibility of having been exposed to malicious content, especially if the site was displaying error messages asking them to execute commands.

Communicate to readers if there was exposure:

• If the ClickFix JavaScript was active, alert the blog audience immediately: readers who executed a command from the fake error message should assume their device may be compromised and conduct a forensic analysis.

‍

Cybersecurity as a strategic priority

CVE-2026-26980 in Ghost CMS illustrates a dynamic that repeats across the 2026 threat landscape — and that Verizon’s DBIR confirmed just yesterday: unpatched vulnerabilities are exploited in hours, not days, and the vector is not always the most monitored critical system — sometimes it is the corporate blog that nobody considers a first-order attack surface.

For any company using Ghost CMS for its blog, newsletter or content hub, today’s question is direct: are you on version 5.120.1 or higher? If you don’t know, the time between CVE publication and active exploitation documented in the 2026 DBIR — measured in hours — has already passed.

‍

Apolo Cybersecurity: content platform protection and CMS injection detection

At Apolo Cybersecurity we help businesses protect their corporate content platforms against vulnerabilities like CVE-2026-26980: Ghost CMS patching status auditing and verification, malicious JavaScript injection detection in published content, Content API log review for suspicious access, forensic cleanup of compromised sites, and incident communication to affected audiences.

If your company runs Ghost CMS self-hosted and has not applied the 5.120.1 update, this Wednesday morning is the time to do it. And if you are not sure whether your installation has already been compromised, that too.

‍