CVE-2026-8467Suspected Plausible entry point
An older /storybook RCE is a suspected route, not a confirmed cause of this intrusion.
Convertr shared analytics script skims checkout payment details
Sansec found payment-data theft through Convertr’s shared tracker. It confirmed cleanup on October 27, but cached scripts may persist for 24 hours. The suspected Plausible entry flaw remains unconfirmed.
- Disclosed
- Oct 26, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- 1 CVE tracked here
- Splash zone
- Shoppers using checkout.convertr pages since October 24; merchant or shopper totals are not established
- e-commerce · supply chain · card skimming
- In the wild
- Yes
- Sansec observed the injected payment skimmer; the initial exploit is unconfirmed.
What happened
This is a newly disclosed skimming incident, not a new disclosure of the older Plausible flaw. Sansec had no Convertr server logs to establish that entry route. L4 reflects observed payment-data theft. See Sansec’s complete indicator section for the broader group’s six Discord webhook paths and additional payload signatures.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Plausible CE — suspected entry flaw only | 3.2.1 | Upgrade alone does not reverse payment-data theft |
Crime-scene timeline
Oct 24, 2026
Sansec detects checkout skimming
Oct 26, 2026
Sansec publicly reports the shared-script compromise
Oct 27, 2026
Sansec confirms the served tracker is clean
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Sansec investigationPrimaryOctober 26 disclosure, October 27 cleanup, full indicators and cache warning; initial entry unconfirmed.
- Plausible advisoryPrimaryOlder suspected entry flaw: affected >=3,<3.2.1, patch 3.2.1, endpoint blocking and investigation.
- BleepingComputerPayment fields include number, expiry, CVV, name and CPF; recommends cache clearing.