critical CVSS 9.8 Actively exploited

CVE-2026-45247·PHP vulnerability

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Severity
critical
Software
PHP
Fixed in
1.11.12
Published
2026-05-26

Affected versions

Until: 1.11.12

Fixed in: 1.11.12

How to fix this CVE

Upgrade the Mirasvit Full Page Cache Warmer module for Magento 2 to version 1.11.12 or later immediately. This critical vulnerability allows remote code execution through a PHP object injection flaw in the CacheWarmer cookie handler. Disable or restrict access to the module until the patch is applied, and audit your server logs for signs of exploitation.

sudo dnf update php php-common php-cli php-fpm

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET request with CacheWarmer cookie containing serialized PHP object patterns: 'O:\d+:"[^"]+":\d+:{' or gadget chain signatures from Magento dependencies beginning with 'a:\d+:{' followed by nested object references

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or sanitize requests containing the CacheWarmer cookie with serialized PHP object patterns (regex: 'O:\d+:|a:\d+:' in cookie values). Implement strict input validation to reject any cookie value that contains PHP serialization markers. Alternatively, disable the Mirasvit module at the WAF level by blocking requests to its endpoints until patching is complete.

How to check if you are affected

  1. Run `php -v` to confirm your PHP version and check if Magento 2 is installed at the web root
  2. Check the Mirasvit module version with: `grep -r 'version' path/to/magento/vendor/mirasvit/module-cache-warmer/composer.json | grep '"version"'`
  3. Search web server logs for requests containing serialized PHP objects in the CacheWarmer cookie: `grep -i 'CacheWarmer' /var/log/apache2/access.log | grep -E 'O:\d+:|a:\d+:'`
  4. Verify the patch is applied by confirming the module version is 1.11.12 or higher and testing that unserialize() calls in the warmer are no longer executed on untrusted input

Indicators of compromise

  • CacheWarmer cookie with base64-encoded or raw serialized PHP objects starting with 'O:' or 'a:'
  • POST requests to Magento cache warmer endpoints with unusual serialized gadget chains in cookies
  • Error logs containing 'unserialize()' warnings or uncaught exceptions from Mirasvit module classes

FAQ

What is CVE-2026-45247?

CVE-2026-45247 is a PHP object injection vulnerability in Mirasvit's Full Page Cache Warmer for Magento 2 that occurs when the module deserializes untrusted data from the CacheWarmer cookie without validation, enabling attackers to instantiate arbitrary objects and chain gadgets for remote code execution.

Is CVE-2026-45247 being actively exploited?

Yes, CVE-2026-45247 is listed in the CISA Known Exploited Vulnerabilities catalog and is actively being exploited in the wild. Immediate patching is critical.

What versions of the Mirasvit Full Page Cache Warmer are affected by CVE-2026-45247?

All versions of the Mirasvit Full Page Cache Warmer for Magento 2 prior to version 1.11.12 are vulnerable. The module is only vulnerable when installed on a Magento 2 instance; standalone PHP is not directly affected.

How do I check if my server is vulnerable to CVE-2026-45247?

Run `grep -r '"version"' vendor/mirasvit/module-cache-warmer/composer.json` in your Magento root directory. If the version is below 1.11.12, your installation is vulnerable. Additionally, check that you have no custom unserialize() calls on cookie input in your codebase.

Does Defensia detect CVE-2026-45247?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Mirasvit Full Page Cache Warmer module is detected on a monitored Magento 2 server, CVE-2026-45247 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-45247. Free for 1 server.

Get started free