Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks
A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980, CVSS 9.4) is being actively exploited to compromise over 700 websites, including high-profile domains. Attackers steal admin API keys to inject JavaScript loaders that power ClickFix fake CAPTCHA attacks. The flaw, discovered by Anthropic's Claude, was patched in February 2026.