Critical Magento Cache Plugin Vulnerability Allows RCE Attacks

Key Takeaways

• A critical unauthenticated remote code execution (RCE) vulnerability has been discovered in the Mirasvit Cache Warmer plugin for Magento and Adobe Commerce.
• The flaw, tracked as CVE-2026-45247, scores a maximum 9.8 CVSS (Critical) and allows attackers to execute arbitrary code without prior authentication or administrative access.
• All versions of Mirasvit Cache Warmer prior to 1.11.12 are affected, impacting potentially thousands of e-commerce storefronts.
• A patch (version 1.11.12) was released on May 25, 2026, and immediate updates are strongly recommended.

Critical RCE Flaw in Magento Cache Plugin

A severe security vulnerability has been identified in a widely deployed caching extension for Magento and Adobe Commerce platforms. This flaw permits threat actors to execute arbitrary code remotely on affected systems without needing any form of authentication, administrative privileges, or prior configuration changes.

Security researchers at Sansec were responsible for uncovering this unauthenticated PHP object injection vulnerability within the Mirasvit Cache Warmer extension. This particular full-page cache extension is utilized by thousands of online storefronts built on Magento and Adobe Commerce.

The vulnerability, formally designated as CVE-2026-45247, has been assigned a critical CVSS score of 9.8, indicating the highest possible severity.

Understanding the Mirasvit Cache Warmer Vulnerability

Mirasvit Cache Warmer’s primary function is to proactively generate and store cached versions of e-commerce pages. This process optimizes performance for various user profiles, considering factors such as currency, customer groups, and other session-specific states.

To achieve this, the plugin packages certain session details into a cookie, which is then transmitted with each cache-warming request. Upon receiving these requests, the server-side component of the plugin reads the cookie’s contents and adjusts the session context accordingly before rendering the page.

The fundamental issue lies in how the plugin processes a specific portion of this cookie’s value. It directly feeds this value into PHP’s native unserialize() function without imposing any class restrictions or performing any authentication checks. Since the cookie’s content is entirely controlled by the client, an attacker can craft a malicious cookie value to inject arbitrary PHP objects, a technique known as PHP Object Injection (CWE-502).

When combined with a “gadget chain”—a sequence of existing classes and methods within Magento and its dependencies—this object injection can be escalated directly into full Remote Code Execution (RCE). The critical aspect of this attack is that it can be triggered by any request to the storefront, not just those related to internal cache-warming operations. This means any public-facing Magento store running the vulnerable plugin is a potential target.

All versions of Mirasvit Cache Warmer preceding 1.11.12 are susceptible to this vulnerability. It’s important to note that this extension is also bundled within several other Mirasvit packages, meaning many merchants may be unknowingly running the vulnerable component.

Sansec’s scanning efforts identified approximately 6,000 stores utilizing Mirasvit extensions. However, the actual number of affected installations is likely considerably higher, as content delivery networks (CDNs) like Cloudflare often obscure the underlying platform from external fingerprinting tools.

Organizations should review their web logs for indicators of compromise. Exploitation attempts typically leave a recognizable footprint, specifically storefront requests containing a CacheWarmer cookie whose value begins with CacheWarmer: followed by a base64-encoded string. Given that serialized PHP objects frequently base64-encode to strings starting with Tz, Qz, or YT, the pattern CacheWarmer:(Tz|Qz|YT) serves as a strong indicator of active exploitation.

What You Should Do

• Update Immediately: Upgrade the Mirasvit Cache Warmer extension to version 1.11.12 or a newer release without delay. The patched version was made available on May 25, 2026.
• Implement WAF Rules: Deploy or configure a web application firewall (WAF) to detect and block exploit attempts that leverage PHP object serialization.
• Scan for Compromise: Conduct thorough scans of your Magento installation for any signs of compromise, including unexpected PHP files, webshells, or backdoors in web-accessible directories such as pub/.
• Audit Installed Extensions: Verify if Mirasvit Cache Warmer is present, even if bundled within other Mirasvit modules, to ensure all instances are updated.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.