Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab)
Ghost CMS Content API SQL Injection CVE-2026-26980 (TL-2026-0575), also tracked as Ghost CMS Page Poisoning Campaign, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-05-24 and last reviewed 2026-08-02. It is attributed to Multi-cluster with low confidence, affects Ghost Foundation Ghost CMS, references 1 CVE (CVE-2026-26980), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 59 indicators of compromise.
Key facts for TL-2026-0575
- Threat ID
- TL-2026-0575
- Also known as
- Ghost CMS Page Poisoning Campaign, Ghost ClickFix Watering Hole, GHSA-w52v-v783-gw97
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-05-24
- Last reviewed
- 2026-08-02
- Attribution
- Multi-cluster
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- education, media, publishing, technology, government, non-profit
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 59
- Updates
- 2026-08-02 · revalidated 1× · latest source
Malware and tooling in Ghost CMS Content API SQL Injection CVE-2026-26980
Malware and tooling: Custom JavaScript loader + PHP cloaker, Electron, Inno Setup
Multi-cluster threat activity is exploiting CVE-2026-26980, an unauthenticated SQL injection in Ghost CMS Content API (slug filter), to dump Admin API Keys and inject malicious JavaScript loaders into article pages. The poisoned pages serve a cloaked second-stage that displays a fake Cloudflare verification overlay (ClickFix), tricking visitors into pasting attacker commands into Windows Run. XLab confirmed 700+ compromised domains including Harvard, Oxford, Auburn, and DuckDuckGo, with payloads ranging from DLL loaders to an Electron-based UtilifySetup.exe.
How Ghost CMS Content API SQL Injection CVE-2026-26980 works
Ghost is a Node.js content management system used by news publishers, universities, and corporate sites. CVE-2026-26980 is an unauthenticated SQL injection in the Content API endpoint GET /ghost/api/content/posts/, rooted in slug-filter-order.js. The function parses slug:[a,b,c] expressions from NQL (Ghost Query Language) filters and concatenates the slug values directly into a raw SQL CASE WHEN ... END ASC fragment used in ORDER BY, with no parameterization. Because NQL's STRING token grammar is more permissive than slugFilterOrder's naive comma split, an attacker can use SQL concatenation operators (||) to stitch attacker-controlled SQL into the ORDER BY clause, enabling arbitrary database reads, including disclosure of the admin_api_keys table. The Content API key required to reach the endpoint is embedded in theme HTML and effectively public. Versions 3.24.0 through 6.19.0 are affected; 6.19.1 (released 2026-02-19) fixes the issue.
Exploitation chain. (1) Unauthenticated SQLi against /ghost/api/content/posts/?filter=slug:[...] returns the Admin API Key. (2) The attacker uses the Admin API Key to call PUT /ghost/api/admin/posts/:id/ and append a small JavaScript loader to the bottom of published articles. The loader is highly recognisable: it base64-decodes a hard-coded stage-2 URL using atob() and POSTs the page origin back using btoa(a.origin). (3) The stage-2 cloaking script fingerprints the visitor (user-agent, geo, prior visit cookies) and decides whether to serve the lure. (4) Qualifying visitors are served a full-screen iframe overlay impersonating Cloudflare's Just-A-Moment human-verification page (FakeCaptcha / ClickFix). The overlay instructs the victim to open Windows Run (Win+R), paste a clipboard-staged command, and press Enter. (5) The clipboard command pulls a ZIP from attacker infrastructure (update.zip, NotepadPlusPlus.zip), expands it, and executes the bundled installer.dll / NotepadPlusPlus.dll via rundll32 or a .cmd/.js launcher. Observed second-stage payloads include the Electron-packaged UtilifySetup.exe (Inno Setup wrapper) and SuperAppizeSetup.msi, which deploy pay-per-install ad/loader malware (sup.exe, publl.dll).
Threat clustering. XLab tracks at least two distinct clusters operating on overlapping target sets. Cluster A uses domains clo4shara[.]xyz, com-apps[.]cc, platecrumbs[.]com (all serving the same /11z77u3.php cloaking script), with payload-staging on cloud-verification[.]com, jalwat[.]com, and taketwolabs[.]com. Cluster B uses the staticcloudflare[.]pro / script-dev[.]digital / script-dev[.]buzz / updatesecurity[.]pro / updatefilescf[.]top family, all sharing the /api/css.js stage-2 URI pattern and partially resolving to 144.31.236.66. The two clusters have been observed cleaning up each other's injected scripts on shared victims and reinfecting, indicating ongoing competition rather than coordination.
Scale and victims. As of XLab's 2026-05-17 enumeration, 700+ live compromised Ghost sites carried the injected loader, up from 156 sites on 2026-05-10. Named victim sites include Harvard University, Oxford University, Auburn University, and DuckDuckGo. The campaign is opportunistic mass exploitation, not targeted intrusion, and effectively turns each compromised CMS into a watering-hole for visitor-side ClickFix social engineering.
Remediation. Upgrade Ghost CMS to >= 6.19.1 immediately. Because Admin API Keys were almost certainly disclosed on any pre-patch Internet-exposed instance, rotate ALL credentials (Admin API Key, Content API Key, administrator passwords, active sessions) after upgrade. Audit posts, snippets, and themes for injected <script> tags or atob() / btoa(a.origin) patterns and remove them at the database level. Review nginx/access logs for GET /ghost/api/content/posts/ requests containing 'slug:[' and '||' substrings, and for PUT /ghost/api/admin/posts/ requests from unfamiliar IPs.
MITRE ATT&CK techniques used in TL-2026-0575
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1218 System Binary Proxy Execution
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Persistence
T1098 Account Manipulation; T1505 Server Software Component
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Impact
defense-impairment
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
Reconnaissance
command-and-control
Affected products and versions in Ghost CMS Content API SQL Injection CVE-2026-26980
- Ghost Foundation — Ghost CMS
Vulnerable versions: 3.24.0 through 6.19.0
Fixed in: 6.19.1
Remediation for Ghost CMS Content API SQL Injection CVE-2026-26980
Patches
- Ghost CMS 6.19.1 (commit 30868d632b2252b638bc8a4c8ebf73964592ed91, released 2026-02-19) — sanitizes slug values in slug-filter-order.js
Immediate actions
- Upgrade Ghost CMS to >= 6.19.1 on every Internet-exposed instance
- After upgrade, rotate Admin API Key, Content API Key, administrator passwords, and invalidate all active admin sessions
- Audit posts, snippets, and themes for injected <script> tags, atob() loaders, and btoa(a.origin) patterns; remove via DB if needed
- Block known Cluster A/B C2 and staging domains (clo4shara.xyz, com-apps.cc, platecrumbs.com, staticcloudflare.pro, script-dev.digital, script-dev.buzz, updatesecurity.pro, updatefilescf.top, cdnupdatenews.top, taketwolabs.com) and the 144.31.236.66 IP at perimeter and DNS
Workarounds
- If immediate upgrade is not possible: place Ghost behind a reverse-proxy WAF and block any request whose query string contains 'filter=slug:' together with '||' or 'CASE'
- Temporarily disable the Content API by removing its key from theme HTML and revoking the key in admin (will break public site features that depend on it)
Longer-term hardening
- Place Ghost admin (/ghost) behind VPN, mTLS, or IP allowlist; never expose admin UI directly on the public Internet
- Deploy a WAF rule blocking Content API requests containing 'slug:[' combined with SQL meta-characters (||, CASE, WHEN, UNION)
- Enable monitoring on Ghost integration / API key creation and rotation events; alert on out-of-band key issuance
- User-side: enforce Windows Group Policy blocking Win+R for non-admin users, restrict mshta/wscript/cscript/rundll32 execution from user-writable paths, and deploy browser policies preventing clipboard write from untrusted origins
- Train end users to recognize and refuse 'paste this into Windows Run' verification prompts regardless of branding
CVEs associated with Ghost CMS Content API SQL Injection CVE-2026-26980
Weaknesses (CWE) in Ghost CMS Content API SQL Injection CVE-2026-26980
CWE-89
Timeline of Ghost CMS Content API SQL Injection CVE-2026-26980
- Ghost CMS 6.19.1 released, fixing CVE-2026-26980 in slug-filter-order.js (commit 30868d632b). GHSA-w52v-v783-gw97 and NVD entry published the same day.
- Public proof-of-concept exploit published on GitHub by user vognik (vognik/CVE-2026-26980), demonstrating unauthenticated Admin API Key extraction via the Content API slug filter.
- FortiGuard releases IPS signature Ghost.CMS.slug.filter.SQL.Injection (ID 60606) covering exploitation of CVE-2026-26980.
- SentinelOne and SonicWall publish technical analyses of CVE-2026-26980 in-the-wild exploitation, including the vulnerable filter=slug:[...] parameter pattern.
- XLab (Qianxin) detects the first Ghost CMS page-poisoning incident: attacker uses CVE-2026-26980 to steal the Admin API Key and uses the Admin API to inject a JavaScript loader at the bottom of articles.
- XLab completes first round of compromised-site enumeration: 156 victim Ghost domains confirmed serving the Cluster A loader.
- Second enumeration round completed: 700+ victim domains confirmed, including Harvard, Oxford, Auburn, and DuckDuckGo. A second distinct threat actor (Cluster B, staticcloudflare[.]pro family) identified operating on overlapping victims.
- New Cluster A C2 domain restrictes.com registered; would go on to front the large majority of live compromised sites.
- XLab publishes full technical writeup with IOC list (two clusters, MD5 hashes for installer.dll, NotepadPlusPlus.dll, UtilifySetup.exe, SuperAppizeSetup.msi, css.js, and 144.31.236.66 C2 IP).
- BleepingComputer (Bill Toulas) publishes mainstream coverage of the XLab findings, amplifying public awareness.
- As of 2026-05-29, this remains a live, in-the-wild campaign: CVE-2026-26980 is patched (Ghost 6.19.1) but the ClickFix watering-hole expanded 156 to 700+ compromised sites in one week with no reported takedown, sinkhole, or arrests. A public PoC exists and two competing clusters keep reinfecting victims, while stolen Admin API keys stay valid on unrotated, already-breached instances.
- SicuraNext scanned 3,153 Shodan-indexed Ghost CMS hostnames for the CVE-2026-26980 injection point, confirming 287 compromised instances, 284 of them fronted by restrictes.com; com-apps.cc found suspended (a dormant registration reused from 2025-09-23).
- SicuraNext published 'Ghost Stories,' disclosing the ghost_once_footer_<hex> in-page loader marker and localStorage single-execution gate, and re-validating that 281 of 287 (97.9%) previously-identified compromised sites remained infected — no material remediation progress.
- VulnCheck's 'State of Exploitation 1H-2026' report names CVE-2026-26980 as the sole AI-discovered vulnerability (of 1,061 analyzed) with independently confirmed in-the-wild exploitation, citing this campaign; report also notes the ClickFix payload includes a code-signed PuTTY-mimicking stealer and a trojanized 'Grape' Electron client using Adspect cloaking to evade scanners.
Update history for TL-2026-0575
- 2026-08-02 — Research: Only 1% of AI-Discovered Vulnerabilities Exploited in the Wild — VulnCheck State of Exploitation 1H-2026 (Anthropic Project Glasswing / CVE-2026-26980 Ghost CMS Case Study): What changed Campaign confirmed still fully active with no material remediation progress: SicuraNext's independent 2026-06-11/06-23 rescans found 287 compromised Ghost instances, with 97.9% (281/287) still infected as of 2026-06-23. Infrast
Sources cited for Ghost CMS Content API SQL Injection CVE-2026-26980
- Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
- Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks
- CVE-2026-26980 — NVD Detail
- GHSA-w52v-v783-gw97 — Ghost has a SQL injection in Content API
- Ghost 6.19.1 release notes
- Ghost fix commit 30868d632b2252b638bc8a4c8ebf73964592ed91
- Ghost CMS Content API Blind SQL Injection — SonicWall analysis
- CVE-2026-26980: Ghost CMS Information Disclosure Flaw — SentinelOne
- Ghost CMS Content API SQL Injection — Pentest-Tools exploit DB
- vognik/CVE-2026-26980 — public PoC exploit
- Ghost.CMS.slug.filter.SQL.Injection — FortiGuard IPS
Threats related to Ghost CMS Content API SQL Injection CVE-2026-26980
- DriveSurge: Initial Access Broker Hijacks Thousands of Trusted Websites for ClickFix and FakeUpdate Malware Delivery via zTDS
- ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT, and EtherRAT - May 2026 Enterprise Compromise
- CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access Broker for DragonForce Ransomware Deployment
Detection coverage for TL-2026-0575
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0575 across Splunk SPL, Microsoft KQL and Sigma, covering 59 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.