{"id":"CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible","kind":"campaign","aliases":[],"related":[],"title":"Magecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages","description":null,"summary":"Sansec found that a Brazilian Magecart group changed the Plausible analytics tracker on a self-hosted Plausible Community Edition server run by Convertr, a Brazilian e-commerce and checkout platform. This group has been active since at least July 2024 and goes after Magento, OpenCart and WooCommerce stores. The tracker loads on the checkout pages of every merchant on Convertr, so the skimmer stole card number, expiry date, CVV, cardholder name and CPF from shoppers. It was found on 2026-10-24. By 2026-10-26 it had been tuned to Convertr's exact payment API field names. Sansec thinks the attackers got in through CVE-2026-8467, an unauthenticated command-execution flaw in outdated Plausible CE, but this is not confirmed. Convertr has removed the skimmer, upgraded Plausible and is notifying merchants and payment providers. Browsers may keep serving the cached bad script for up to 24 hours. More broadly, any team that self-hosts an outdated Plausible CE whose tracker loads on payment pages faces the same risk. The number of victims is unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T21:09:34+00:00","products":[{"name":"Convertr","fixed":[],"vendor":"Convertr"},{"name":"Plausible Community Edition","fixed":[],"vendor":"Plausible Analytics"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Find out whether your checkout runs on Convertr: look for 'checkout.convertr' in the checkout page address. Card payments made there since 2026-10-24 may be compromised. If you self-host Plausible Community Edition, check its version against CVE-2026-8467. Compare the served tracker script (script.js and its variants) with the official release, and look for code that reads payment form fields or sends data to unknown hosts. The sources publish no skimmer domains or hashes (unknown).","fix":"Convertr merchants: confirm with Convertr that the cleanup is done, tell your payment provider, and warn customers who paid by card since 2026-10-24 to ask their bank to block the card. Self-hosted Plausible CE: upgrade to a patched version, check the tracker file for tampering, and keep the server off the public internet where you can. Don't load third-party or analytics scripts on payment pages, or pin them with Subresource Integrity and a strict CSP.","status":"open","published_at":null,"first_seen_at":"2026-10-27T21:09:34+00:00","triaged_at":"2026-10-27T21:09:34+00:00","updated_at":"2026-10-27T21:09:34+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':122B,126B '-2026':148B '-202610':21A '-24':123B '-26':127B '-8467':149B '2024':81B '2026':121B,125B '24':190B 'activ':76B 'analyt':11A,50B 'api':137B 'attack':143B 'bad':185B 'brazilian':17A,44B,65B 'broad':193B 'browser':179B 'cach':184B 'campaign':36B 'card':14A,106B 'cardhold':111B 'ce':159B,203B 'chang':47B 'checkout':18A,70B,95B 'cmp':20A 'command':153B 'command-execut':152B 'commerc':68B 'communiti':58B 'community':34A 'confirm':164B 'convertr':5A,27A,32A,63B,101B,133B,165B 'cpf':114B 'cve':147B 'cvv':110B 'data':15A 'date':109B 'e':67B 'e-commerc':66B 'earli':38B 'early-warn':37B 'edit':59B 'edition':35A 'everi':98B 'exact':135B 'execut':154B 'expiri':108B 'face':210B 'field':138B 'flaw':155B 'found':41B,119B 'goe':83B 'got':144B 'group':46B,73B 'host':9A,56B,199B 'hosted':30A 'hour':191B 'in':26A 'juli':80B 'keep':181B 'least':79B 'load':92B,206B 'magecart':1A,23A,45B 'magecart-skimmer-planted-in-convertr-s-self-hosted-plausible':22A 'magento':85B 'may':180B 'merchant':99B,175B 'name':112B,139B 'notifi':174B 'number':107B,215B 'opencart':86B 'outdat':157B,201B 'page':19A,96B,209B 'payment':136B,177B,208B 'plant':3A 'planted':25A 'platform':71B 'plausibl':10A,49B,57B,158B,171B,202B 'plausible':31A,33A 'provid':178B 'remov':167B 'risk':213B 'run':61B 's':28A 'sansec':40B,140B 'script':12A,186B 'self':8A,29A,55B,198B 'self-host':7A,54B,197B 'serv':182B 'server':60B 'shopper':116B 'sinc':77B 'skimmer':2A,24A,104B,169B 'steal':13A 'stole':105B 'store':89B 'team':195B 'think':141B 'tracker':51B,91B,205B 'tune':131B 'unauthent':151B 'unknown':219B 'upgrad':170B 'victim':217B 'warn':39B 'whose':204B 'woocommerc':88B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:57:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T21:09:34+00:00","fetched_at":"2026-10-27T21:09:34+00:00","note":null}],"documents":[{"id":7776,"url":"https://t.co/2AbAACgT9j","title":"Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer, citing Sansec)","kind":"blog","source":"analyst","text":"BleepingComputer (Bill Toulas, Oct 27 2026), citing Sansec: a Magecart group (Brazilian, active since at least July 2024, targets Magento, OpenCart, WooCommerce) modified the Plausible analytics tracker on a self-hosted Plausible Community Edition server run by Brazilian e-commerce/checkout platform Convertr; the tracker loads on checkout pages of all merchants on the platform. Identified Oct 24. Sansec suspects CVE-2026-8467 (unauthenticated command execution in outdated Plausible CE) for initial access, not confirmed. By Oct 26 skimmer refined to Convertr's payment API field names. Steals card number, expiry, CVV, cardholder name, CPF. Affected: card payments on Brazilian stores with 'checkout.convertr' in checkout URL since Oct 24. Convertr removed the skimmer and upgraded Plausible; notifying merchants and payment providers. Browser cache may keep malicious script up to 24h. No skimmer domains/IOCs in the article.","published_at":"2026-10-27T20:57:25+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}