Sansec reported on 26 October 2026 that a Brazilian Magecart group it says has been active since 2024 planted a payment skimmer in the self-hosted Plausible Community Edition analytics tracker run by Brazilian checkout platform Convertr (analytics.convertr.app.br).

According to Sansec, from 24 October checkout.convertr pages that loaded the tracker sent the card number, expiry date, CVV, cardholder name and CPF (Brazilian taxpayer number) to 1x0.is, and the skimmer was updated on 26 October to target the exact field names of Convertr's payment API.

According to Sansec, Convertr says its merchants have sold more than R$2 billion (about €320 million) through the platform and that browsers may cache the script for up to 24 hours. Sansec suspects the entry point was CVE-2026-8467, an unauthenticated command-execution flaw via /storybook in Plausible CE 3.0.0 to 3.2.0 that Plausible fixed in May 2026 (Sansec advises upgrading to 3.2.1 or later), but says it cannot confirm this.

In a 27 October update Sansec said Convertr had removed the skimmer, upgraded Plausible and was notifying merchants, payment providers and authorities, and that Sansec had confirmed the tracker was clean.

Sansec said it had notified Convertr but received no response before its 26 October publication, and BleepingComputer (27 Oct) said it contacted Convertr for a statement and had not received a response.

Correction (28 Oct 2026): removed a 15 May 2026 fix date that no linked source gives (Sansec says Plausible fixed the flaw in May 2026), corrected 'tracked since July 2024' to Sansec's 'active since 2024', credited the R$2 billion sales figure to Convertr as reported by Sansec, and changed the title to say Sansec reported the removal on 27 October rather than giving that as the removal date. (source: Sansec)