Sansec found an unauthenticated PHP object injection flaw in Mirasvit Cache Warmer, a popular Magento full-page cache extension. A single crafted cookie on any storefront page can lead to remote code execution. Mirasvit has shipped a fix.
Sansec discovered an unauthenticated PHP object injection vulnerability in Mirasvit Cache Warmer, a full-page cache extension for Magento and Adobe Commerce. Any storefront request carrying a crafted CacheWarmer cookie reaches PHP's native unserialize() on attacker-controlled data, with no authentication, no admin session and no config toggle required. With a suitable gadget chain, this leads to remote code execution.
The flaw is tracked as CVE-2026-45247 , rated 9.8 (critical). Mirasvit released a patched version (1.11.12) on May 25, 2026 and is asking all customers to update.
Sansec Shield customers were protected on April 24, 2026, the day we found the flaw.
Mirasvit Cache Warmer pre-populates Magento's full-page cache for every "vary" state of a page (currency, customer group, and so on). To render a page as a specific visitor, the warmer packs the target session state into a cookie and sends it with each crawl request. On the server, a plugin reads that cookie and switches currency and customer session to match before rendering.
The plugin runs on every storefront request, not just on warmer traffic.
The extension deserializes part of the cookie value with PHP's native unserialize() , without restricting which classes may be instantiated. Because that value comes straight from the client, an attacker controls the objects PHP reconstructs. This is PHP object injection (CWE-502). Combined with a gadget chain from classes that Magento and its dependencies already ship, object injection escalates to remote code execution.
All Mirasvit Cache Warmer versions before 1.11.12 are vulnerable. The extension is bundled with several Mirasvit packages, so many merchants run it without having installed it directly.
Sansec scans found roughly 6,000 stores running Mirasvit extensions. Real numbers are likely higher, since content delivery networks such as Cloudflare hide many installs from our fingerprinting.
The attack leaves a clear request signature. Look for storefront requests that carry a CacheWarmer cookie whose value contains the marker CacheWarmer: followed by a base64 string. Serialized PHP objects base64-encode to values starting with Tz , Qz or YT , so a CacheWarmer cookie value matching CacheWarmer:(Tz|Qz|YT) is a strong indicator of an exploitation attempt.
Mirasvit responded fast, shipping a fix within days of our report. Merchants should update without delay: the flaw needs no authentication, fires on ordinary storefront traffic, and the request signature is trivial for attackers to automate once the patch reveals the fix.
Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.
eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
