{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts · updates",
  "home_page_url": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026",
  "feed_url": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026/feed.json",
  "description": "From Oct 24 2026 a Brazilian Magecart group appended a card skimmer to the Plausible analytics tracker hosted on Convertr's own server. Convertr runs the online stores and checkout for dozens of Brazilian fashion brands, and every checkout.convertr page loaded that file, so card numbers, expiry dates, CVVs, cardholder names and CPF numbers were sent to the attacker. Sansec suspects the entry point was CVE-2026-8467 in Convertr's never-updated Plausible Community Edition 3.0 (unconfirmed). Convertr removed the skimmer and upgraded Plausible on Oct 27.",
  "language": "en",
  "_pwn": {
    "slug": "convertr-plausible-tracker-magecart-skimmer-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-27-aa66ad8b",
      "url": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-27-aa66ad8b",
      "title": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: Sansec confirms Convertr removed the skimmer and upgraded Plausible to a patched version; Convertr says it is notifying affected merchants, payment providers and authorities. Browsers may cache the infected script for up to 24 hours.",
      "content_text": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: Sansec confirms Convertr removed the skimmer and upgraded Plausible to a patched version; Convertr says it is notifying affected merchants, payment providers and authorities. Browsers may cache the infected script for up to 24 hours.\n\nSource: https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-26-d3e916b8",
      "url": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-26-d3e916b8",
      "title": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: The attacker ships a refined skimmer targeting the exact field names of Convertr's payment API. Sansec publishes its research and names Plausible CE CVE-2026-8467 (unauthenticated RCE via /storybook, fixed in 3.2.1) as the suspected but unconfirmed entry point; Convertr is still serving the skimmer.",
      "content_text": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: The attacker ships a refined skimmer targeting the exact field names of Convertr's payment API. Sansec publishes its research and names Plausible CE CVE-2026-8467 (unauthenticated RCE via /storybook, fixed in 3.2.1) as the suspected but unconfirmed entry point; Convertr is still serving the skimmer.\n\nSource: https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-24-36b10713",
      "url": "https://pwn.watch/i/convertr-plausible-tracker-magecart-skimmer-oct-2026#2026-10-24-36b10713",
      "title": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: Sansec first sees a card skimmer appended to the Plausible tracker on analytics.convertr.app.br, Convertr's self-hosted Plausible Community Edition server that every Convertr checkout loads. It sends card number, expiry, CVV, cardholder name and CPF to 1x0.is.",
      "content_text": "Magecart skimmer planted in Convertr's self-hosted Plausible tracker hits Brazilian checkouts: Sansec first sees a card skimmer appended to the Plausible tracker on analytics.convertr.app.br, Convertr's self-hosted Plausible Community Edition server that every Convertr checkout loads. It sends card number, expiry, CVV, cardholder name and CPF to 1x0.is.\n\nSource: https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "date_published": "2026-10-24T00:00:00.000Z",
      "external_url": "https://sansec.io/research/convertr-plausible-supply-chain-attack",
      "tags": [
        "high"
      ]
    }
  ]
}