CyberRota Analysis
AI-GeneratedGhost's public donation checkout flow is vulnerable, allowing unauthenticated attackers to manipulate donation metadata and acquire paid gift memberships for a minimal payment. While customer and member data remain secure, the potential for unauthorized access to paid features poses a risk to site integrity. Organizations using Ghost versions 6.27.0 through 6.43.0 should prioritize upgrading to version 6.44.0 to mitigate this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control donation checkout metadata and obtain full paid gift memberships for a minimal payment without exposing customer or member data or stealing money from a site or its members. This issue is fixed in version 6.44.0.