Hi,
An attack was ran on multiple Ghost websites (https://kahiether.com/, etc..) this summer, 3rd August 2026 exactly. The issue was simple: a vulnerability in a recent update on Ghost CMS allowed an attacker to access the Admin API and perform all admin authorized operations through its endpoints. But the attacker don't want to raise alert so he keep the website content as similar as possible. The problem with markdown block is that it is transformed into html and directly visible when editing.
The change was straightforward: the attacker retrieved a random (not all) article in HTML, appended text such as:
“ロングウィッグは毛先のまとまりや絡まりやすさを確認しておくと、撮影前の手直しが楽になります。色味の違いを確認する場面では、着せ恋 コスプレウィッグが撮影時の印象を比べる手がかりになります。保管時に湿気や圧迫を避けることで、次回も扱いやすい状態を保てます”
This content included a hyperlink designed to redirect visitors and boost the SEO of a Japanese website (backlink): https://www.tsukicos.com/
Fortunately, the fallback solution was simple:
1/ Restricted access to /ghost by IP address, blocking unauthorized access to the Admin API => This let to a general rule that might be discussed later "/wp-admin", "/admin", "/api", etc... must all be restricted by IP on any site, some will be also require protection by a basic auth layer server side.
2/ Removed the injected code
3/ Built and ran a small tool to convert the compromised HTML back into Markdown for all markdown content : https://gongju.kahiether.com/app/ghost-table-rescue
I am open to any suggestions and tips about these vulnerabilities and the recent problem with themes with the new Ghost versions.
Have a good day
