Live › campaign › CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible
Go to dashboardSansec found that a Brazilian Magecart group changed the Plausible analytics tracker on a self-hosted Plausible Community Edition server run by Convertr, a Brazilian e-commerce and checkout platform. This group has been active since at least July 2024 and goes after Magento, OpenCart and WooCommerce stores. The tracker loads on the checkout pages of every merchant on Convertr, so the skimmer stole card number, expiry date, CVV, cardholder name and CPF from shoppers. It was found on 2026-10-24. By 2026-10-26 it had been tuned to Convertr's exact payment API field names. Sansec thinks the attackers got in through CVE-2026-8467, an unauthenticated command-execution flaw in outdated Plausible CE, but this is not confirmed. Convertr has removed the skimmer, upgraded Plausible and is notifying merchants and payment providers. Browsers may keep serving the cached bad script for up to 24 hours. More broadly, any team that self-hosts an outdated Plausible CE whose tracker loads on payment pages faces the same risk. The number of victims is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:09 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Convertr | – | – | – |
| Plausible Community Edition | – | – | – |
checkout.convertr in the checkout page addressEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible")