Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 is affected by CVE-2026-45247. It passes a crafted PHP serialized object from the CacheWarmer cookie to unsafe unserialize() processing. Gadget chains in Magento and its dependencies can then allow unauthenticated arbitrary code execution.
Vulnerability Overview and Scope of Impact
CVE-2026-45247 is a critical PHP object injection vulnerability affecting versions of Mirasvit Full Page Cache Warmer for Magento 2 prior to 1.11.12. This issue stems from the insecure processing of specially crafted serialized PHP objects via the `CacheWarmer` cookie by PHP's `unserialize()` function.
Attackers can exploit gadget chains present in Magento and its dependencies to achieve Remote Code Execution (RCE), potentially leading to full control over the affected server. CISA has confirmed that this vulnerability is being actively exploited and mandates federal agencies to remediate it by June 5, 2026.
Specific Impacts and Attack Scenarios
By exploiting this vulnerability, unauthenticated attackers can inject specially crafted PHP objects into the CacheWarmer cookie and execute arbitrary PHP code on the server. This could lead to devastating consequences such as website defacement, sensitive data theft, backdoor installation, and even complete server compromise. For Magento sites operating online stores, customer data breaches and business disruption would have severe impacts.
Immediate Actions for Engineers
Update to 1.11.12 or later and investigate administrator changes, customer-data access, added files, scheduled tasks, and outbound connections. VulnCheck publishes CVSS v4.0 9.3 CRITICAL and v3.1 9.8 CRITICAL. A simple cookie-blocking regex can miss payload variants and is not a substitute for the official update.
📦