The vulnerability is a classic SQL injection (CWE-89) in Ghost’s Content API that permits an attacker to read arbitrary data from the database. Because the flaw can be triggered without authentication, it compromises the confidentiality of all content stored in Ghost.

TryGhost Ghost version 3.24.0 through 6.19.0 is affected. The fix is provided in 6.19.1 and later releases; installations older than 6.19.1 remain vulnerable.

The CVSS score of 9.4 indicates critical severity, and the EPSS score of 70% indicates a significant probability that attackers will target this vulnerability. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation would let an attacker retrieve any database table content; the attack vector appears to be a simple HTTP request to the exposed Content API, which is inferred from the description that unauthenticated attackers can trigger it via the API, implying a low barrier to exploitation.