CVE-2026-45247

published 2026-05-26

CVE-2026-45247: Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to…

Priority P1 96 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

KEV ITW EXPLOIT Initial access

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mirasvit	full_page_cache_warmer	< 1.11.12	1.11.12
mirasvit	full_page_cache_warmer_for_magento_2	< 1.11.12	1.11.12

Detection & IOCs extracted from sources · hover to see the quote

cookie CacheWarmer:<base64>↗

bytes↗

CacheWarmer:(Tz|Qz|YT)

• → Detect exploitation attempts by matching HTTP requests containing a CacheWarmer cookie whose value begins with 'CacheWarmer:' followed by a Base64-encoded serialized PHP object. Base64-encoded serialized PHP objects characteristically start with 'Tz', 'Qz', or 'YT'. ↗
• → Observed payloads are base64-encoded serialized objects delivered via malicious HTTP requests targeting any storefront endpoint — no authentication or admin privileges are required, so all storefront routes are in scope. ↗
• → Attackers have been observed sending test/canary commands to validate successful RCE before proceeding — look for anomalous command-execution output in web server responses or error logs alongside CacheWarmer cookie activity. ↗
• → The vulnerability is exploitable via any storefront request; no specific endpoint path is required, making WAF rules scoped to the CacheWarmer cookie value the most reliable detection layer. ↗

• · Approximately 6,000 stores running Mirasvit extensions were identified, but the true number is likely higher because CDNs such as Cloudflare mask installs — asset/install-count-based scoping will undercount exposure. ↗
• · RCE is achieved via gadget chains already present in Magento core and its dependencies — no additional malicious library needs to be present on the server for exploitation to succeed. ↗
• · All versions of Mirasvit Full Page Cache Warmer prior to 1.11.12 are affected; the fix was released on May 25, 2026. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vulncheck 9.3 CRITICAL

cisa 9.3 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502