CVE-2026-45247
About
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Rainforest analyst review
The Mirasvit Full Page Cache Warmer extension for Magento 2 passes attacker-controlled input straight into PHP's `unserialize()`. An unauthenticated attacker places a crafted serialized PHP object in the CacheWarmer cookie, and when the extension deserializes it, the object-injection triggers a gadget chain built from classes already present in Magento and its dependencies. That chain drives the application into executing arbitrary code on the server — a classic PHP object-injection escalation from an unauthenticated request to full RCE.
Magento runs e-commerce storefronts, so a compromised server exposes customer data and payment flows and is a prime target for skimming and card-harvesting code injected into checkout — the Magecart pattern that has plagued the platform for years. Third-party extensions are a recurring weak point precisely because they widen the attack surface beyond Magento core, and a cookie-triggered pre-auth RCE needs only a single request. Upgrade Full Page Cache Warmer to 1.11.12 or later, and because store compromise often manifests as injected client-side skimmers, review the storefront for unauthorized code, unexpected admin users, and modified checkout templates in addition to patching.
References
- https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
- https://sansec.io/research/mirasvit-cache-warmer-object-injection
- https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/
Related CVEs
Frequently asked questions
What is CVE-2026-45247?
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.
How severe is CVE-2026-45247?
CVE-2026-45247 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2026-45247 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2026-45247?
Public advisories list the following as affected: full page cache warmer. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2026-45247?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.