Mirasvit Full Page Cache Warmer for Magento 2 before version 1

CVE-2026-45247 is a PHP object injection bug in Mirasvit Full Page Cache Warmer for Magento 2 that affects all versions before 1.11.12. The extension reads a client-supplied CacheWarmer cookie on ordinary storefront requests and passes attacker-controlled data into PHP unserialize(). Because Magento and its dependencies provide usable gadget chains, this is not just theoretical deserialization noise; it can become unauthenticated remote code execution on the web server.

The vendor's CRITICAL 9.8 rating is mostly deserved in practice. The only meaningful downward pressure is population size: this is a third-party Magento extension, not Magento core, so reachability is narrower than the raw CVSS suggests. But that friction is overwhelmed by the ugly amplifiers: unauthenticated remote trigger, ordinary web traffic path, internet-facing storefront exposure, server-level compromise, and CISA KEV evidence as of 2026-06-03.

Why this verdict

• No-auth internet path: the attacker starts from ordinary web access to the storefront; there is no requirement for prior compromise, credentials, or user interaction.
• Extension-only scope is the main friction: this is not Magento core, so the exposed population is narrower than the raw 9.8 suggests; that trims the score slightly but not the severity bucket.
• KEV overrides comfort metrics: the supplied EPSS is low, but KEV status and public exploitation evidence are stronger signals than a fresh-model probability estimate.
• Blast radius is server-level, not feature-level: once exploited, the attacker owns the PHP app context and can plant skimmers, webshells, or credential theft logic across the storefront.

Why not higher?

It is not higher than 9.4 because the reachability depends on a specific third-party extension being present and enabled. That is real population friction compared with a core Magento flaw or a ubiquitous server component, so I would shave the score a bit even while keeping the CRITICAL bucket.

Why not lower?

A lower rating would ignore the key reality that this is unauthenticated RCE over the public storefront with KEV evidence. There is no internal-network, post-auth, or special-role prerequisite to push this down into HIGH; the only real brake is install base, and that is not enough.

1. Block the CacheWarmer cookie at the edge — Deploy a WAF/CDN rule within hours that denies or strips suspicious CacheWarmer cookies, especially values matching Sansec's CacheWarmer:(Tz|Qz|YT) pattern. This buys time only for stores that cannot patch immediately; because this is KEV-listed, treat edge blocking as emergency containment, not closure.
2. Disable the module if business can tolerate it — If cache warming is non-essential, disable mirasvit/module-cache-warmer or remove the extension within hours on exposed storefronts. That removes the vulnerable code path entirely and is the cleanest compensating control short of patching.
3. Hunt for dropped PHP in web-reachable paths — Review pub/, media-adjacent writable locations, and any custom upload directories today for unexpected PHP files, altered templates, or skimmer logic. This matters because successful RCE on Magento commonly turns into webshell or checkout-skimmer persistence very quickly.
4. Search logs for exploit signatures — Query reverse-proxy, CDN, and web-server logs today for requests carrying the CacheWarmer cookie, especially serialized-object prefixes and unusual base64 blobs. This is one of the rare RCEs with a pretty solid request-layer hunting indicator.
5. Tighten Linux app telemetry on these hosts — If you cannot patch immediately, enable or tune EDR/FIM for web-root writes, new PHP files, cron changes, and outbound connections from the PHP worker within hours. That will not prevent exploitation, but it improves your odds of catching the monetization phase.

Run this on the target Magento host from the Magento application root, for example: sudo bash ./check-cve-2026-45247.sh /var/www/html/magento. It needs read access to composer.lock, composer.json, and optionally vendor/mirasvit/module-cache-warmer/etc/module.xml; root is not required if the Magento files are readable.

#!/usr/bin/env bash
# check-cve-2026-45247.sh
# Detects whether a Magento instance is vulnerable to CVE-2026-45247
# by checking installed version of mirasvit/module-cache-warmer.
#
# Usage:
#   bash check-cve-2026-45247.sh /path/to/magento
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

TARGET_DIR="${1:-.}"
PACKAGE="mirasvit/module-cache-warmer"
FIXED="1.11.12"

if [ ! -d "$TARGET_DIR" ]; then
  echo "UNKNOWN: target directory not found: $TARGET_DIR"
  exit 2
fi

LOCK_FILE="$TARGET_DIR/composer.lock"
JSON_FILE="$TARGET_DIR/composer.json"
MODULE_XML="$TARGET_DIR/vendor/mirasvit/module-cache-warmer/etc/module.xml"

version_lt() {
  # returns 0 (true) if $1 < $2
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_from_lock() {
  local file="$1"
  python3 - "$file" "$PACKAGE" <<'PY'
import json, sys
path, package = sys.argv[1], sys.argv[2]
try:
    with open(path, 'r', encoding='utf-8') as f:
        data = json.load(f)
except Exception:
    sys.exit(1)
for section in ('packages', 'packages-dev'):
    for pkg in data.get(section, []) or []:
        if pkg.get('name') == package:
            ver = pkg.get('version', '')
            print(ver.lstrip('v'))
            sys.exit(0)
sys.exit(1)
PY
}

extract_from_composer_json() {
  local file="$1"
  python3 - "$file" "$PACKAGE" <<'PY'
import json, sys
path, package = sys.argv[1], sys.argv[2]
try:
    with open(path, 'r', encoding='utf-8') as f:
        data = json.load(f)
except Exception:
    sys.exit(1)
for section in ('require', 'require-dev'):
    reqs = data.get(section, {}) or {}
    if package in reqs:
        print(str(reqs[package]).strip())
        sys.exit(0)
sys.exit(1)
PY
}

VERSION=""
SOURCE=""

if [ -f "$LOCK_FILE" ] && command -v python3 >/dev/null 2>&1; then
  VERSION="$(extract_from_lock "$LOCK_FILE" 2>/dev/null)"
  if [ -n "$VERSION" ]; then
    SOURCE="composer.lock"
  fi
fi

if [ -z "$VERSION" ] && [ -f "$JSON_FILE" ] && command -v python3 >/dev/null 2>&1; then
  VERSION="$(extract_from_composer_json "$JSON_FILE" 2>/dev/null)"
  if [ -n "$VERSION" ]; then
    SOURCE="composer.json"
  fi
fi

if [ -z "$VERSION" ] && [ -f "$MODULE_XML" ]; then
  # Module exists but version may not be recoverable reliably from filesystem alone.
  echo "UNKNOWN: module files present but version not reliably determined; check composer metadata manually"
  exit 2
fi

if [ -z "$VERSION" ]; then
  echo "PATCHED: package $PACKAGE not found in composer metadata"
  exit 0
fi

# Normalize common Composer constraints / prefixes when extracted from composer.json.
NORM="$VERSION"
NORM="${NORM#v}"
NORM="${NORM#~}"
NORM="${NORM#^}"
NORM="${NORM#>=}"
NORM="${NORM#=}"
NORM="${NORM%% *}"
NORM="${NORM%%,*}"

case "$NORM" in
  ''|dev-*|*@*|*x-dev*|*@dev*|*'||*' )
    echo "UNKNOWN: found non-concrete version '$VERSION' in $SOURCE"
    exit 2
    ;;
esac

if version_lt "$NORM" "$FIXED"; then
  echo "VULNERABLE: $PACKAGE version $VERSION detected via $SOURCE; fixed version is $FIXED"
  exit 1
else
  echo "PATCHED: $PACKAGE version $VERSION detected via $SOURCE; fixed version is $FIXED"
  exit 0
fi

Sources

1. NVD CVE-2026-45247
2. Sansec disclosure
3. Mirasvit Cache Warmer changelog
4. CISA KEV catalog query
5. VulnCheck advisory
6. Vulners mirror of VulnCheck KEV metadata
7. FIRST EPSS data and stats