Vulnerabilities & Exploits · Web App Attack

Magento Stores Hit by WebRTC Payment Skimmer Exploiting PolyShell

A WebRTC-based payment skimmer is exploiting the PolyShell vulnerability in Magento Open Source and Adobe Commerce to steal checkout payment data.

1 source · Mar 26

Timeline

• Mar 26 Reported by The Hacker News

Sources

• Mar 26 The Hacker News

  WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

  WebRTC skimmer exploits PolyShell flaw since March 19, hitting 56.7% stores, enabling stealth data theft bypassing CSP.

  original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: Magento Stores Hit by WebRTC Payment Skimmer Exploiting PolyShell

More from today

• Langflow Code-Injection Flaw Actively Exploited After Disclosure
• Unauthenticated RCE in Secure Firewall Management Center
• Immediate Attacks Target Oracle WebLogic RCE Flaw