CVE-2026-26980

Ghost CMS versions 3.24.0 through 6.19.0 contain an unauthenticated SQL injection flaw (CWE-89) that lets a remote attacker trigger arbitrary reads against the site's database over the network, with no privileges or user interaction required. The attacker gains read access to database contents — high confidentiality impact per the CVSS vector (C:H/I:N/A:N), which can expose user, post, and session data. Any Ghost deployment running a release within the affected range is exposed, and the fix is in version 6.19.1. The flaw is not yet in the CISA KEV catalog and no public PoC is catalogued, but news reports indicate active in-the-wild exploitation: attackers have already hijacked more than 700 Ghost sites and used them to deliver ClickFix social-engineering attacks.

What to do: Upgrade to Ghost 6.19.1 or later immediately if running any version from 3.24.0 through 6.19.0. Given the high EPSS (70.2% in 30 days) and confirmed mass exploitation, review logs for unauthenticated database-reading requests, rotate credentials and invalidate sessions in case sensitive data was read, and check site content and admin accounts for tampering consistent with the reported ClickFix hijacking campaign.