---
id: "CMP-202610-magecart-skimmer-planted-in-convertr-s-self-hosted-plausible"
kind: "campaign"
aliases: []
title: "Magecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Convertr", "fixed": [], "vendor": "Convertr"}, {"name": "Plausible Community Edition", "fixed": [], "vendor": "Plausible Analytics"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T21:09:34+00:00"
updated_at: "2026-10-27T21:09:34+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T21:09:34+00:00"}]
---

# Magecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pages

Sansec found that a Brazilian Magecart group changed the Plausible analytics tracker on a self-hosted Plausible Community Edition server run by Convertr, a Brazilian e-commerce and checkout platform. This group has been active since at least July 2024 and goes after Magento, OpenCart and WooCommerce stores. The tracker loads on the checkout pages of every merchant on Convertr, so the skimmer stole card number, expiry date, CVV, cardholder name and CPF from shoppers. It was found on 2026-10-24. By 2026-10-26 it had been tuned to Convertr's exact payment API field names. Sansec thinks the attackers got in through CVE-2026-8467, an unauthenticated command-execution flaw in outdated Plausible CE, but this is not confirmed. Convertr has removed the skimmer, upgraded Plausible and is notifying merchants and payment providers. Browsers may keep serving the cached bad script for up to 24 hours. More broadly, any team that self-hosts an outdated Plausible CE whose tracker loads on payment pages faces the same risk. The number of victims is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Convertr affected ? fixed ?
- :Plausible Community Edition affected ? fixed ?

## How to check

Find out whether your checkout runs on Convertr: look for 'checkout.convertr' in the checkout page address. Card payments made there since 2026-10-24 may be compromised. If you self-host Plausible Community Edition, check its version against CVE-2026-8467. Compare the served tracker script (script.js and its variants) with the official release, and look for code that reads payment form fields or sends data to unknown hosts. The sources publish no skimmer domains or hashes (unknown).

## Fix

Convertr merchants: confirm with Convertr that the cleanup is done, tell your payment provider, and warn customers who paid by card since 2026-10-24 to ask their bank to block the card. Self-hosted Plausible CE: upgrade to a patched version, check the tracker file for tampering, and keep the server off the public internet where you can. Don't load third-party or analytics scripts on payment pages, or pin them with Subresource Integrity and a strict CSP.

## Timeline

- 2026-10-27T21:09:34+00:00 analyst

## Documents

- [describes] Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer, citing Sansec) https://t.co/2AbAACgT9j

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_