CVE-2026-45247

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-45247
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer Release Notes
https://sansec.io/research/mirasvit-cache-warmer-object-injection Third Party Advisory
https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 US Government Resource
https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mirasvit:full_page_cache_warmer:*:*:*:*:*:magento:*:*
History

03 Jun 2026, 19:55

Type Values Removed Values Added
CPE cpe:2.3:a:mirasvit:full_page_cache_warmer:*:*:*:*:*:magento:*:*
First Time Mirasvit
Mirasvit full Page Cache Warmer
References () https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer - () https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer - Release Notes
References () https://sansec.io/research/mirasvit-cache-warmer-object-injection - () https://sansec.io/research/mirasvit-cache-warmer-object-injection - Third Party Advisory
References () https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection - () https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection - Third Party Advisory
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 - US Government Resource
References () https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/ - () https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/ - Third Party Advisory

03 Jun 2026, 19:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247 -
  • () https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/ -

26 May 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-26 15:16

Updated : 2026-06-03 19:55

NVD link : CVE-2026-45247

Mitre link : CVE-2026-45247

CVE.ORG link : CVE-2026-45247

JSON object : View

Products Affected

mirasvit

  • full_page_cache_warmer
CWE
CWE-502

Deserialization of Untrusted Data