A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout.
The vulnerability or weakness
The attackers exploited CVE-2026-8467, an unauthenticated command-execution vulnerability affecting Convertr’s outdated Plausible Community Edition installation, to gain initial access.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-8467 | 9.5 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Convertr's sales, which total R$2 billion ($370M) annually, are at risk due to potential data breaches, impacting operations and potentially leading to legal and reputational damage.
Industries affected
The incident primarily affects e-commerce platforms and fashion brands using Convertr, as well as their customers.
Users affected
Shoppers who made card payments on Brazilian stores using Convertr since October 24 should contact their banks to block their cards.
Build these skills
Sources
- Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer)
