Back Thehackernews

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Thehackernews •[email protected] (The Hacker News) • May 25, 2026

Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.

According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in a large-scale cyberattack affecting over 700 websites, including those of Harvard University, Oxford University, Auburn University, and DuckDuckGo. The vulnerability allows unauthenticated attackers to read arbitrary data from the database, including sensitive admin API keys. Attackers leverage these keys to inject malicious JavaScript into articles, facilitating ClickFix attacks that trick users into executing harmful commands. Despite a patch being released on February 19, 2026, many sites remain unpatched and vulnerable. The campaign was first detected by XLab researchers at Qianxin on May 7, 2026, and has since expanded rapidly. The malicious scripts serve a fake Cloudflare verification prompt, leading victims to inadvertently download malware. The situation is ongoing as of May 25, 2026, with multiple threat actors involved. 17 sources 78

Extracted Entities

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)