CVE-2026-26980 is an SQL injection vulnerability in the Ghost CMS that allows unauthenticated attackers to extract sensitive data, including authentication tokens and user credentials. Exploitation enables attackers to obtain the Admin API key and modify website content by injecting malicious JavaScript loaders designed for ClickFix attacks. The vulnerability was patched in February 2026, but mass exploitation campaigns have compromised over 700 websites by May 2026. The affected sites include major universities and well-known organizations. Multiple attacker groups are actively conducting these poisoning operations, sometimes competing on the same targets.

Exploitation of CVE-2026-26980 allows attackers to extract sensitive data from Ghost CMS databases, including authentication tokens and user credentials, leading to unauthorized administrative access. Attackers have used this access to alter website content by injecting malicious JavaScript, potentially impacting website integrity and visitor security. Over 700 websites have been compromised, including high-profile targets, indicating widespread impact. The presence of competing attacker groups suggests ongoing active exploitation and persistent risk to unpatched Ghost CMS instances.

A patch for CVE-2026-26980 was released in February 2026. Site operators should ensure their Ghost CMS installations are updated to the latest patched version to remediate the SQL injection vulnerability. Since the vulnerability is actively exploited in the wild, immediate patching is critical. Additionally, compromised sites should be thoroughly inspected for injected malicious code and cleaned. Operators should rotate any exposed credentials or API keys. No vendor advisory content contradicts these recommendations.