CVE-2026-45247 — unauthenticated RCE in a Magento extension via PHP object injection

CVE-2026-45247: PHP object injection (deserialization of untrusted data, CWE-502) in the Mirasvit Full Page Cache Warmer Magento 2 extension before 1.11.12 → unauthenticated RCE, CVSS 9.3. What it is, the affected range, and the fixes to do now — defensively, without attack steps.

Published 2026-06-08 Updated 2026-10-04 Last verified 2026-08-02 4 min read

A bulletin on an actively exploited vulnerability (listed in CISA KEV). What happens, the affected range, and the fixes — explained defensively, with no attack steps.

Advisory

CVE: CVE-2026-45247
Severity: Critical (CVSS 9.3 / v4.0)
Class: PHP object injection (deserialization of untrusted data, CWE-502)
Impact: Unauthenticated remote code execution (RCE)
Affected: Mirasvit Full Page Cache Warmer for Magento 2 — before 1.11.12
Main fix: Update to 1.11.12 or later

9.3

CVSS / worst class

no auth

Reach condition

RCE

Impact reached

fixed by update

Main fix

Why neglect is dangerous

Unauthenticated RCE is a prime target for automated mass scanning (that's why it's KEV-listed). "We're too small to be targeted" doesn't hold — scanners sweep the whole internet mechanically.

What the vulnerability is (PHP object injection)

PHP has serialize to stringify data and unserialize to restore it. Deserializing untrusted input as-is lets an attacker pass "an object that causes unwanted side effects when restored." During restoration (magic methods, etc.), unintended behavior chains together and can reach code execution. That's PHP object injection (CWE-502).

✗ Restore untrusted input

external input → unserialize into an object → restore chain → code execution

✓ Treat as data

accept external input only as data (JSON, etc.) → never reconstruct objects

Deserializing untrusted input reconstructs an attacker-supplied object and chains into unintended behavior. Treated as data, it stays safe.

The affected component is a cache-warming extension for Magento 2. The attacker reaches it without authentication, and CVSS rates it 9.3, among the most severe.

Affected range

Item	Detail
Extension	Mirasvit Full Page Cache Warmer for Magento 2
Affected versions	before 1.11.12
Fixed version	1.11.12 and later
Precondition	No authentication required
Impact reached	Remote code execution (RCE)

Fixes

Update to 1.11.12+ (top priority)

Update the extension to the latest. This is the only thing that actually closes the RCE. Afterwards, confirm the version actually running.

Temporary defense in depth until you patch

If you can't patch immediately, restrict access to the endpoint (IP allowlist, basic auth, cut the path) or use a WAF to reduce exposure temporarily. This only covers the gap until you patch.

Check for compromise

Assume it may have been reached before patching: inspect for unfamiliar files, scheduled tasks, outbound traffic, and admin-account changes. Treat RCE as "env and DB may have leaked."

Inventory extensions + machine CVE monitoring

Inventory installed extensions/dependencies and watch CVEs with machines (Dependabot / osv-scanner). Structurally prevent "a published, known CVE left unpatched because a human missed it."

This site's view: design so untrusted data is never deserialized

This kind of flaw keeps appearing because it's "convenient" to restore external input directly. This site's stance is plain: never create a place that unserializes untrusted data. Accept external input only as data (e.g. json_decode), never to reconstruct objects. Then this kind of flaw cannot occur by design.

FAQ

QWhat does CVE-2026-45247 allow?

An unauthenticated attacker can execute arbitrary code (RCE) on a Magento site running the affected extension — a direct path to defacement, data theft, and a way into other systems. It's among the most severe kinds of vulnerability.

QWhat's the most reliable fix?

Update the 'Mirasvit Full Page Cache Warmer for Magento 2' extension to 1.11.12 or later. Only the update actually closes it; config changes and a WAF are temporary defense in depth until you can patch.

QWhat is PHP object injection?

Deserializing untrusted input as-is (via unserialize, etc.) so an attacker-supplied object gets reconstructed, chaining into unintended behavior (CWE-502). The real defense is to never deserialize untrusted data.

What the vulnerability is (PHP object injection)

Affected range

Fixes

Read next

FAQ