CVE-2026-45247

What it actually does

Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12 uses PHP's native unserialize() on attacker-controlled data from the CacheWarmer cookie. Because the cookie is accepted from unauthenticated HTTP requests and deserialized without a safe type allowlist, an attacker can provide a crafted serialized PHP object that triggers Magento or dependency gadget chains. Successful exploitation can result in arbitrary PHP code execution in the context of the web server process, enabling file writes, command execution, credential theft, persistence, and full compromise of the Magento application host.

Why it matters to the business

This is a critical unauthenticated remote code execution issue affecting internet-facing Magento stores that use the vulnerable Mirasvit extension. Exploitation can lead to storefront takeover, payment data exposure, customer data theft, malware or skimmer deployment, order manipulation, downtime, and reputational damage. The vulnerability is listed in CISA KEV with a remediation deadline of 2026-06-06 and is reported as actively exploited in the wild, so exposed systems should be treated as high-priority incident-response candidates, not just routine patch targets.

How an attack unfolds

An attacker first identifies a Magento 2 storefront using the vulnerable Mirasvit Full Page Cache Warmer extension. They then send an unauthenticated HTTP request containing a malicious CacheWarmer cookie. The cookie value contains a serialized PHP object crafted to match a usable gadget chain present in Magento or one of its dependencies. When the extension processes the cookie, it calls unserialize() on attacker-controlled input, causing PHP magic methods or destructors in the gadget chain to execute. Depending on the chain, the attacker can run arbitrary PHP code, write a web shell, execute system commands, modify application files, steal Magento secrets and database credentials, or establish persistence. Post-exploitation activity commonly focuses on credential harvesting, payment-skimmer deployment, administrator account creation, or staging additional malware.

How to fix it

Upgrade Mirasvit Full Page Cache Warmer for Magento 2 to version 1.11.12 or later. If immediate upgrade is not possible, disable the Full Page Cache Warmer extension until it can be patched. Block or alert on requests containing suspicious serialized PHP object syntax in the CacheWarmer cookie at the WAF or reverse proxy, but do not rely on filtering as the primary fix. Rotate Magento admin credentials, application secrets, API tokens, and database credentials if exploitation is suspected. Review the Magento filesystem for unauthorized PHP files, modified core files, malicious JavaScript, new admin users, cron jobs, and persistence mechanisms. Because the issue is in CISA KEV and actively exploited, exposed instances should receive both patching and compromise assessment.

How to confirm the fix worked

Confirm the installed Mirasvit Full Page Cache Warmer version is 1.11.12 or later using Magento module inventory, Composer package metadata, vendor extension records, or administrative extension management. Verify that the vulnerable code path no longer unserializes the CacheWarmer cookie with unrestricted PHP unserialize(). Test that requests containing serialized PHP object-like values in the CacheWarmer cookie are rejected, ignored, or handled safely and do not cause PHP errors, object instantiation, or command execution. Review WAF, web server, PHP-FPM, and Magento logs for historical CacheWarmer cookie probes before declaring the system clean. Run file-integrity checks against Magento application directories and compare against known-good deployments or vendor packages.

Typical attack path

1. Scan internet-facing Magento sites for indicators that the Mirasvit Full Page Cache Warmer extension is installed or reachable.
2. Send unauthenticated HTTP requests containing a crafted CacheWarmer cookie with serialized PHP object data.
3. Trigger unsafe PHP deserialization through the extension’s call to unserialize().
4. Leverage Magento or dependency gadget chains to execute attacker-controlled code.
5. Write or execute a payload such as a PHP web shell, command runner, skimmer, or persistence mechanism.
6. Access Magento configuration secrets, database credentials, customer data, order data, or payment-related application flows.
7. Maintain access, clean up obvious traces, or use the compromised store for fraud, malware distribution, or lateral movement.

How to detect it

Look for exploitation attempts and post-exploitation artifacts across HTTP access logs, WAF/CDN logs, reverse proxy logs, PHP-FPM logs, Magento application logs, system authentication logs, cron records, file-integrity monitoring, and EDR telemetry. The strongest request-level signal is an unauthenticated request with a CacheWarmer cookie containing PHP serialized object syntax such as O:, C:, a:, s:, or URL-encoded equivalents. Investigate HTTP 500 errors or PHP fatal errors occurring shortly after CacheWarmer cookie requests, especially errors mentioning unserialize(), __wakeup(), __destruct(), or unexpected classes. Review the Magento filesystem for recently created or modified PHP files in web-accessible directories, suspicious JavaScript added to checkout or theme assets, unexpected files in media/upload locations, and changed extension files. Check for new Magento admin users, modified payment or checkout configuration, unauthorized cron entries, outbound network connections from PHP or the web server user, and execution of shell utilities by the web server process. Because this vulnerability is reported as actively exploited in the wild, treat matching serialized CacheWarmer cookie requests as potential compromise indicators and correlate them with file changes, process execution, credential access, and administrative changes around the same timestamp.

• CacheWarmer=
• Cookie: CacheWarmer=
• CacheWarmer=O:
• CacheWarmer=O%3A
• CacheWarmer=C:
• CacheWarmer=C%3A
• CacheWarmer=a:
• CacheWarmer=a%3A
• CacheWarmer=s:
• CacheWarmer=s%3A
• unserialize()
• unserialize(): Error at offset
• __wakeup
• __destruct
• Mirasvit\\CacheWarmer
• Mirasvit\CacheWarmer
• /pub/media/
• /pub/static/
• /var/log/exception.log
• /var/log/system.log

What your security team should do

• Immediately inventory Magento 2 deployments for Mirasvit Full Page Cache Warmer and identify versions earlier than 1.11.12.
• Patch to Mirasvit Full Page Cache Warmer 1.11.12 or later, or disable the extension until the update is complete.
• Prioritize internet-facing stores because the vulnerability is unauthenticated, network-exploitable, actively exploited, and listed in CISA KEV with a 2026-06-06 remediation deadline.
• Search historical web, WAF, CDN, reverse proxy, PHP-FPM, and Magento logs for CacheWarmer cookie values containing serialized PHP object patterns.
• If suspicious requests are found, perform incident response: preserve logs, collect filesystem evidence, review admin accounts, inspect cron jobs, hunt for web shells and skimmers, and rotate secrets.
• Add temporary WAF/SIEM detections for serialized PHP syntax in the CacheWarmer cookie while patching is underway.
• Review Magento file integrity, especially public web directories, extension directories, generated code, media uploads, and JavaScript assets for unauthorized changes.
• Rotate Magento admin passwords, API keys, encryption keys, database credentials, and payment integration secrets if exploitation cannot be ruled out.
• Monitor for follow-on activity such as new admin users, unusual checkout-page JavaScript, outbound connections from the web server, and unexpected PHP processes.