Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks

Reported 21 May 2026 by otx · Severity: medium

Attackers exploited CVE-2026-26980, a critical SQL injection vulnerability in Ghost CMS, to obtain Admin API Keys without authorization and conduct mass website poisoning campaigns. Over 700 domains across multiple industries including universities, blockchain, AI, security resea