---
title: Hackers Use Ghost CMS Flaw to Infect 700+ Websites With ClickFix Malware
description: Discover how a critical Ghost CMS flaw (CVE-2026-26980) enabled hackers to infect over 700 sites with malware. Patch and secure your site now.
canonical_url: https://codekeeper.co/ticker/ghost-cms-vulnerability-exploited-by-hackers
---

# Hackers Use Ghost CMS Flaw to Infect 700+ Websites With ClickFix Malware

Discover how a critical Ghost CMS flaw (CVE-2026-26980) enabled hackers to infect over 700 sites with malware. Patch and secure your site now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 30, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980, CVSS 9.4) has been exploited by at least two hacker groups to quietly poison over 700 websites with ClickFix malware. The flaw sits in Ghost's Content API and lets unauthenticated attackers steal Admin API keys, then rewrite article content at scale. It was disclosed and patched on February 19, 2026 in Ghost 6.19.1, with versions 3.24.0 through 6.19.0 vulnerable — so the sites hit in May had been exposed for three months. Researchers at Qianxin XLab spotted the campaign on May 7: 156 poisoned domains by May 10, more than 700 by May 17. Victims span universities, blockchain, AI, fintech and media, including Harvard, Oxford and Auburn. Visitors saw nothing suspicious — malicious JavaScript hid at the bottom of articles, eventually serving a fake Cloudflare verification page that tricked users into running malware themselves. Ghost CMS admins should patch to 6.19.1 or later and rotate every key and admin password — XLab watched cleaned sites get reinfected where old Admin API keys still worked. Then audit access logs for unusual bulk PUT requests. Source: [Cyber Security News](https://cybersecuritynews.com/hackers-exploit-ghost-cms-cve-2026-26980/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fghost-cms-vulnerability-exploited-by-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Coding Mistake Left Six Microsoft 365 Android Apps Vulnerable to Account Takeover Aug 12, 2026](https://codekeeper.co/ticker/microsoft-android-apps-security-flaw-patched)

[Cyberattacks McKesson Confirms Breach as ShinyHunters Claims 284 Million Records Sep 7, 2026](https://codekeeper.co/ticker/mckesson-cyberattack-shinyhunters-data-breach)

[Cyberattacks Fake Recruiters Infected 30,000 PCs in a $10.7M Crypto Theft Sep 21, 2026](https://codekeeper.co/ticker/fake-recruiter-scheme-north-korea-hackers)

[Cyberattacks Claude AI Used to Run Nearly Every Stage of a Live Ransomware Campaign Aug 20, 2026](https://codekeeper.co/ticker/ai-driven-ransomware-attacks-gambit-security-report)