CVE-2026-45247: critical vulnerability in Mirasvit Full Page Cache Warmer for Magento 2
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A vulnerability in Mirasvit Cache Warmer for Magento allows attackers to send a specially crafted cookie that tricks the server into executing malicious code without needing to log in. This happens because the plugin unsafely processes serialized data.
The vulnerability exploits unsafe deserialization via PHP's unserialize() function on the CacheWarmer cookie parameter without validation. Unauthenticated attackers can leverage available gadget chains in Magento and its dependencies to achieve remote code execution. No authentication or user interaction is required; a single HTTP request with a malicious serialized object is sufficient for exploitation.
The full analysis of this CVE is available in Portuguese →