CVE-2026-45247 in Full Page Cache Warmer for Magento 2
Summary
by MITRE • 05/26/2026
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/03/2026
This vulnerability resides within the Mirasvit Full Page Cache Warmer module for Magento 2, specifically affecting versions prior to 1.11.12. The flaw represents a critical security weakness that enables unauthenticated remote code execution through a carefully crafted PHP object injection attack. The vulnerability manifests when the application processes a CacheWarmer cookie containing serialized PHP data without proper sanitization or validation, creating an exploitable path for malicious actors to execute arbitrary commands on the affected server.
The technical implementation of this vulnerability leverages PHP's native unserialize() function, which operates without restrictions on the types of objects being deserialized. This unrestricted deserialization creates an ideal environment for exploitation, as attackers can craft malicious serialized objects that, when processed by the application, trigger unintended behavior. The vulnerability aligns with CWE-502, which specifically addresses "Deserialization of Untrusted Data" and represents one of the most dangerous classes of vulnerabilities in PHP applications. The attack vector exploits the fact that Magento 2 and its dependencies contain numerous gadget chains that can be chained together to achieve remote code execution through the deserialization process.
The operational impact of this vulnerability is severe and far-reaching, as it allows attackers to execute arbitrary code on the target server with the privileges of the web application. This means that an attacker could potentially gain full control over the Magento installation, access sensitive customer data, modify product information, execute database commands, or even establish persistent backdoors. The unauthenticated nature of the exploit makes it particularly dangerous, as no prior access credentials are required to initiate the attack. The vulnerability can be exploited through a simple HTTP request containing the malicious CacheWarmer cookie, making it easily accessible to threat actors with minimal technical expertise.
The exploitation process typically involves constructing a serialized PHP object that includes gadget chains from Magento's codebase or its dependencies such as Zend Framework or Symfony components. These gadget chains are sequences of method calls that, when executed during deserialization, can lead to remote code execution. The attack follows the typical pattern described in the MITRE ATT&CK framework under T1059.007 for "Command and Scripting Interpreter: PowerShell" and T1105 for "Remote File Transfer," as the attacker can execute commands and potentially transfer additional malware. Organizations should immediately implement the recommended mitigations including updating to version 1.11.12 or later, implementing proper input validation for cookie data, and applying web application firewalls to detect and block suspicious serialized object patterns.
Mitigation strategies should focus on eliminating the root cause by properly validating and sanitizing all input data before deserialization occurs. Security practitioners should implement strict type checking, use safe deserialization methods, and consider employing object whitelisting techniques to prevent unauthorized object instantiation. The solution approach aligns with industry best practices outlined in the OWASP Top Ten and should be integrated into the application's security architecture as part of a comprehensive defense-in-depth strategy. Organizations should also conduct thorough security assessments of their Magento installations to identify similar vulnerabilities in other third-party modules and ensure that all components are kept up to date with the latest security patches.