CVE-2026-45247
Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
In short
A vulnerability in Mirasvit Cache Warmer for Magento allows attackers to send a specially crafted cookie that tricks the server into executing malicious code without needing to log in. This happens because the plugin unsafely processes serialized data.
Technical detail
The vulnerability exploits unsafe deserialization via PHP's unserialize() function on the CacheWarmer cookie parameter without validation. Unauthenticated attackers can leverage available gadget chains in Magento and its dependencies to achieve remote code execution. No authentication or user interaction is required; a single HTTP request with a malicious serialized object is sufficient for exploitation.
Summary generated and translated by AI from the official description.
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Mirasvit · Full Page Cache Warmer for Magento 2public PoCs found — 2
githubgithub.com/HORKimhab/CVE-2026-45247★ 0githubgithub.com/fevar54/PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmerhttps://sansec.io/research/mirasvit-cache-warmer-object-injectionhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection