Paper/Archive/CVE-2026-45247

CVE-2026-45247

Mirasvit Full Page Cache Warmer for Magento 2 — Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

KEV · due 6 Jun EPSS 26%public exploit SSVC act CVSS 9.8

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 98.0.980 × 2019.6 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Affected

ProductAffectedFixed inSource

Full Page Cache Warmer for Magento 2< 1.11.121.11.12CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeupsansec.io/research/mirasvit-cache-warmer-object-injection patchmirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer writeupvulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection refimperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 kevcisa.gov/known-exploited-vulnerabilities-catalog