CVE-2026-45247 | BDVDB-2026-335113 Detail
MirasvitFull Page Cache Warmer for Magento 2
Description#
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-502 Deserialization of Untrusted Data
References#
- https://sansec.io/research/mirasvit-cache-warmer-object-injection
- https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer
- https://www.vulncheck.com/advisories/mirasvit-cache-warmer-for-magento-php-object-injection
- https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-45247-in-mirasvit-full-page-cache-warmer-for-magento/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45247
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.