--- title: Ghost CMS SQL injection flaw exploited in large-scale... description: A large-scale attack campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0, affecting over... canonical: https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign | daily.dev og:description: A large-scale attack campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0, affecting over... og:url: https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl og:image: https://api.daily.dev/og/posts/gfCwOtBVL.png og:image:alt: Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 2 upvotes · 0 comments ## Summary A large-scale attack campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0, affecting over 700 domains including Harvard, Oxford, and DuckDuckGo. Attackers steal admin API keys via the flaw, then inject malicious JavaScript into articles that serves fake Cloudflare ClickFix prompts, tricking visitors into running malicious commands on Windows. Multiple payload types have been observed, including DLL loaders and an Electron-based malware sample. A patch was released in Ghost 6.19.1 on February 19, but many sites remain unpatched. Admins are urged to upgrade immediately, rotate all API keys, audit injected scripts using provided IoCs, and maintain 30 days of admin API call logs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments - [Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites](https://daily.dev/posts/hackers-are-mass-exploiting-a-gravity-smtp-flaw-to-steal-api-keys-from-100-000-wordpress-sites-hhj1prnxn) · The Next Web · 0 upvotes · 0 comments - [Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin](https://daily.dev/posts/hackers-exploit-info-disclosure-bug-in-gravity-smtp-wordpress-plugin-4vu35e6v7) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign","url":"https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl"},"datePublished":"2026-05-24T14:21:40.991Z","dateModified":"2026-05-24T15:42:33.796Z","description":"A large-scale attack campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0, affecting over...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e98aae91f28eba2c7ee63a272b471f3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e98aae91f28eba2c7ee63a272b471f3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign-gfcwotbvl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sql,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign"}]} ```