Mirasvit Full Page Cache Warmer for Magento 2 PHP Object Injection RCE Vulnerability (CVE-2026-45247)

1. Apply Official Security Patch

Upgrade the Mirasvit Full Page Cache Warmer module to version 1.11.12 or later immediately.

# Update the module via Composer
composer update mirasvit/module-cache-warmer
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento cache:clean

2. Temporary Mitigation (WAF / Web Server Rules)

If immediate patching is not possible, configure your Web Application Firewall (WAF) or Nginx reverse proxy to block requests containing serialized PHP objects in the CacheWarmer cookie.

Nginx Mitigation Example:

# Block requests where the CacheWarmer cookie contains PHP serialization patterns (e.g., O: or a:)
if ($http_cookie ~* "CacheWarmer=[a-zA-Z0-9%]*[Oa]:[0-9]+") {
    return 403;
}

This vulnerability (CVE-2026-45247) is a critical PHP Object Injection (CWE-502) vulnerability discovered in the Mirasvit Full Page Cache Warmer extension for Magento 2.

Root Cause & Exploit Mechanics

• Insecure Deserialization: The extension processes the user-supplied CacheWarmer cookie value using PHP's native unserialize() function without proper validation or sanitization.
• Gadget Chain Exploitation: An unauthenticated attacker can craft a malicious serialized PHP object utilizing existing gadget chains within Magento 2 core or its third-party dependencies.
• Remote Code Execution (RCE): When the application deserializes the payload injected into the CacheWarmer cookie, it triggers the gadget chain, leading to arbitrary code execution on the underlying server.

Threat Severity

• CVSS 9.8 (Critical): Requires no authentication, has low attack complexity, and can completely compromise the confidentiality, integrity, and availability of the host.
• CISA KEV Listed: This vulnerability is actively exploited in the wild, making immediate remediation highly critical.