CVE-2026-45247: Mirasvit Full Page Cache Warmer PHP object injection in cookie

CVE-2026-45247 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-05-26

Mirasvit Full Page Cache Warmer is a performance optimization tool for Magento e-commerce websites. A critical security flaw allows unauthenticated attackers to take full control of the web server by sending a specially crafted browser cookie. This could lead to the theft of customer data, site defacement, or complete service disruption, and there are reports that this vulnerability is being actively exploited in the wild.

Quick answers

Is CVE-2026-45247 exploited in the wild?
Yes. CVE-2026-45247 is known to be exploited in the wild, first recorded on 3 June 2026. Treat it as urgent.
How severe is CVE-2026-45247?
Critical severity, with a CVSS score of 9.8, published 26 May 2026.
Which products and versions are affected?
Mirasvit Full Page Cache Warmer < 1.11.12, before 1.11.12.
Is there a fix for CVE-2026-45247?
A patch was published on 2026-05-26: Fixed in version 1.11.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45247 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45247?
Check whether you run Mirasvit Full Page Cache Warmer or Mirasvit Full Page Cache Warmer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PHP object injection vulnerability exists in Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12. The flaw stems from an unrestricted call to the native PHP unserialize() function on data provided via the 'CacheWarmer' HTTP cookie. An unauthenticated remote attacker can exploit this by providing a malicious serialized PHP object. When combined with existing gadget chains in Magento or its dependencies, this leads to arbitrary remote code execution (RCE) on the underlying server. This vulnerability has been reported as exploited in the wild.

Affected products

  • Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12

Timeline

  • 2026-05-26: disclosed: Initial disclosure and NVD entry creation
  • 2026-06-03: advisory: Publication of vulnerability details
  • 2026-06-03: exploited: Reported as exploited in the wild
  • 2026-05-26: patched: Fixed in version 1.11.12

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.