Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts
Convertr e-commerce checkout (self-hosted Plausible CE tracker)
From Oct 24 2026 a Brazilian Magecart group appended a card skimmer to the Plausible analytics tracker hosted on Convertr's own server. Convertr runs the online stores and checkout for dozens of Brazilian fashion brands, and every checkout.convertr page loaded that file, so card numbers, expiry dates, CVVs, cardholder names and CPF numbers were sent to the attacker. Sansec suspects the entry point was CVE-2026-8467 in Convertr's never-updated Plausible Community Edition 3.0 (unconfirmed). Convertr removed the skimmer and upgraded Plausible on Oct 27.
Why this severity: Shared analytics script on every Convertr checkout skimmed full card data and CPF for about three days
- Started
- Oct 24, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
Sansec confirms Convertr removed the skimmer and upgraded Plausible to a patched version; Convertr says it is notifying affected merchants, payment providers and authorities. Browsers may cache the infected script for up to 24 hours.
The attacker ships a refined skimmer targeting the exact field names of Convertr's payment API. Sansec publishes its research and names Plausible CE CVE-2026-8467 (unauthenticated RCE via /storybook, fixed in 3.2.1) as the suspected but unconfirmed entry point; Convertr is still serving the skimmer.
Sansec first sees a card skimmer appended to the Plausible tracker on analytics.convertr.app.br, Convertr's self-hosted Plausible Community Edition server that every Convertr checkout loads. It sends card number, expiry, CVV, cardholder name and CPF to 1x0.is.
Advisories2
News & write-ups2
Posts1
Hackers hijack Convertr analytics script to steal payment card data t.co/2AbAACgT9j t.co/2AbAACgT9j
Notes & caveats
The CVE-2026-8467 entry point is Sansec's hypothesis; it has not seen Convertr's server logs. Convertr had not answered Sansec or BleepingComputer as of Oct 27.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
