A SQL Bug in a Blogging Tool Just Became a ClickFix Delivery Truck
Attackers turned 700+ Ghost CMS sites into watering holes by exploiting CVE-2026-26980, smuggling fake CAPTCHA prompts that trick visitors into running malware on themselves.
Think of Ghost CMS as the Substack you self-host: a clean blogging platform favored by newsrooms, indie writers, and a surprising number of corporate marketing teams. That's exactly what makes the current campaign nasty. Attackers are exploiting CVE-2026-26980, a critical SQL injection flaw in Ghost's Content API, to seed more than 700 legitimate sites with malicious JavaScript that funnels visitors into ClickFix attacks.
The bug carries a CVSS of 9.4 and lets an unauthenticated attacker read arbitrary data from the underlying database, said researchers at QiAnXin XLab, who flagged the in-the-wild exploitation. From there, the operators are pivoting to script injection on hijacked sites.
ClickFix (the social-engineering trick where a fake CAPTCHA or "fix this error" prompt tells you to paste a command into Run or your terminal) has had a breakout year. It works because it outsources the malware execution to the victim, bypassing every download warning your browser throws.
And that's the part worth sitting with.
A compromised Ghost blog is the perfect funnel. Visitors trust the URL bar, the site looks fine, and the injected script renders a convincing verification overlay. Paste the PowerShell. Game over.
Ghost's maintainers shipped a fix in versions 5.130.3 and 6.4.0, and the release notes on GitHub lay out the patched builds. Self-hosters who haven't updated since October are the soft targets here — Ghost(Pro) customers were patched centrally. If you run your own instance, check your version string right now, not after lunch.
The broader pattern is what's interesting. ClickFix started as a phishing payload, graduated to malvertising, and is now being grafted onto n-day CMS exploits at scale. We saw the same lifecycle with SEO poisoning and fake browser updates: a technique proves itself in one delivery channel, then jumps to whichever channel offers the most trusted real estate. Right now, that's your favorite small publisher's blog.
A couple of practical notes. Content Security Policy headers with a strict script-src would have neutered the injection on most of these sites — almost nobody runs them on a marketing blog. And endpoint controls that block clipboard-to-PowerShell handoffs (Microsoft has been quietly tightening this in Defender) are the closest thing to a real ClickFix mitigation that doesn't depend on user behavior.
The Ghost flaw is patched. The delivery model isn't going anywhere.
Watch for the next CMS with a published n-day to inherit the same playbook within weeks.
