CVE-2026-45247 Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data
Unauthenticated attackers can achieve remote code execution via PHP object injection in the CacheWarmer cookie of the Mirasvit Cache Warmer plugin.
- Exploited in the wild
- Since 3 Jun 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45247?
CVE-2026-45247 is a critical unsafe deserialization vulnerability in Mirasvit Full Page Cache Warmer for Magento 2, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Weakness: CWE-502
Which versions are affected by CVE-2026-45247?
It affects 1 product.
Products include Mirasvit Full Page Cache Warmer.
How do I fix CVE-2026-45247?
No fix has been published for CVE-2026-45247 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Jun 2026.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-45247 being exploited?
Yes. Attackers have exploited CVE-2026-45247 in the wild since at least 3 Jun 2026.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-rg8p-9rpg-r32p.