Ghost flaw exposes publishers to malware

Hackers are exploiting a critical vulnerability in Ghost CMS to compromise more than 700 websites and turn trusted publishing pages into delivery points for ClickFix malware, escalating concerns over unpatched content management systems used by media, universities, fintech firms, software companies and research organisations.

The flaw, tracked as CVE-2026-26980, is a SQL injection vulnerability in Ghost’s Content API. It affects Ghost versions from 3.24.0 through 6.19.0 and was fixed in version 6.19.1, released in February 2026. The vulnerability carries a critical severity rating because attackers can exploit it without authentication to read arbitrary database contents, including sensitive configuration data and API keys.

The campaign has moved beyond data exposure. Attackers are using the vulnerability to obtain Ghost Admin API keys, which provide far greater control than the public Content API keys normally used to retrieve published material. With administrative access, they can alter posts, inject malicious JavaScript and poison pages at scale without needing to break into the server through a conventional login route.

The injected code is being used to trigger ClickFix attack flows, a social-engineering technique that tricks users into running malicious commands on their own devices. Visitors may be shown fake verification prompts, including counterfeit CAPTCHA-style pages, that instruct them to copy and execute commands under the pretext of fixing browser access or confirming they are human. Once executed, those commands can install malware, steal credentials or prepare the device for further compromise.

Security teams have identified at least two threat clusters involved in the activity, with some websites appearing to be modified more than once as rival operators compete for access. The first signs of the campaign were detected on 7 May 2026, months after the patch became available, underlining a familiar gap between vulnerability disclosure and operational remediation.

The affected sites span several sectors where user trust is central to the business model. Academic institutions, software-as-a-service platforms, blockchain projects, media publishers, financial technology companies and cybersecurity-related sites have all appeared among compromised domains. This makes the campaign more damaging than ordinary web defacement because the malicious prompts are delivered from legitimate domains that visitors may already know and trust.

Ghost is widely used by publishers, newsletters, independent media operations and companies that need a lightweight content platform. Its open-source model, clean publishing workflow and Node. js architecture have made it attractive to organisations that want an alternative to heavier content management systems. That reach also means a single critical flaw can create a broad attack surface when self-hosted deployments are not patched promptly.

The technical risk is sharpened by the difference between Ghost’s Content API and Admin API. Content API keys are designed to be public-facing and allow read access to published content. Admin API keys, by contrast, can enable management actions. Once attackers extract administrative credentials from the database, they can use legitimate Ghost functionality to make unauthorised changes that may not immediately resemble a server compromise.

Administrators running vulnerable Ghost versions face several priorities. Upgrading to Ghost 6.19.1 or later is the central fix, while sites that may already have been exposed should rotate Admin API keys, review staff accounts, check for unauthorised script tags, inspect modified posts and examine access logs for suspicious Content API requests. Security teams are also advised to scan published pages for external JavaScript loaders and unexpected redirects.

Temporary filtering at a reverse proxy or web application firewall may reduce exposure by blocking suspicious Content API filter patterns linked to the exploit, though such measures can interfere with legitimate filtering functions. They should not be treated as a substitute for patching, particularly where public-facing publishing systems serve large audiences.

The incident reflects a broader trend in cybercrime: attackers are increasingly using trusted websites as staging points rather than relying only on spam attachments or rogue domains. ClickFix campaigns have gained traction because they combine technical compromise with user manipulation. A user who would ignore an unknown download link may follow instructions displayed on a familiar website, especially if the message is framed as a browser or security check.