PHP Object Injection Vulnerability Affecting Mirasvit Full Page Cache Warmer for Magento 2
A vulnerability affecting Mirasvit Full Page Cache Warmer would allow an unauthenticated attacker to cause remote arbitrary code execution on affected systems.
Description
Technical context and vulnerability details
Mirasvit Full Page Cache Warmer is an extension for Magento 2 and Adobe Commerce, used to optimize the performance of online stores through cache management. This tool is affected by the vulnerability labeled CVE-2026-45247, due to insecure deserialization of data transmitted via the CacheWarmer cookie. Exploitation of this vulnerability would allow an unauthenticated malicious actor, by sending specially crafted requests, to execute arbitrary code remotely on affected systems. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Total server compromise;
- Disclosure of sensitive information;
- Damage to system integrity and availability;
Affected systems
Products, components and targeted versions
- Mirasvit Full Page Cache Warmer for Magento 2, all versions prior to 1.11.12;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Mirasvit Full Page Cache Warmer to version 1.11.12 or later;
Sources & External Links
Vendor security advisories and documentation
- https://www.cve.org/CVERecord?id=CVE-2026-45247
- https://nvd.nist.gov/vuln/detail/CVE-2026-45247
- https://sansec.io/research/mirasvit-cache-warmer-object-injection
- https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.