CVE-2026-45247
Description
CVE-2026-45247 is a critical PHP object injection vulnerability in Mirasvit Full Page Cache Warmer for Magento 2 allowing remote code execution.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| full_page_cache_warmer | * | 1.11.12 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately update the Mirasvit Full Page Cache Warmer extension for Magento 2 to version 1.11.12 or later. This version replaces the insecure unserialize() function with safer data handling methods to prevent PHP object injection.
Update affected systems
Verify the version of all installed Mirasvit modules. Any version of Full Page Cache Warmer prior to 1.11.12 is vulnerable. Use Composer to update the 'mirasvit/module-cache-warmer' package to the latest secure release.
Restrict access
Deploy Web Application Firewall (WAF) signatures to inspect the 'CacheWarmer' cookie. Block any incoming requests where this cookie contains PHP serialization signatures, such as 'O:', 'a:', or 's:', which are characteristic of object injection attacks.
Monitor for exploitation
Audit web server access logs for suspicious activity targeting the 'CacheWarmer' cookie. Monitor for unusual system-level process execution (e.g., bin/sh, curl, or wget) originating from the web server user, which may indicate a successful RCE attempt.
Detection Guidance
To detect exploitation attempts, monitor HTTP traffic for the 'CacheWarmer' cookie header. Look for patterns associated with PHP serialization, specifically strings starting with 'O:' (objects) or 'a:' (arrays). Security teams should also check Magento logs for 'unserialize()' errors and inspect the filesystem for unauthorized PHP files in the pub/media or var directories, which are common targets for web shells following an RCE event.