Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a critical PHP object injection vulnerability (CVE-2026-45247). This issue allows unauthenticated remote attackers to achieve remote code execution by supplying a malicious serialized PHP object in the CacheWarmer cookie. The vulnerability is due to an unrestricted call to PHP's unserialize() function, which, when combined with existing gadget chains in Magento and its dependencies, enables arbitrary code execution on the server. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits have been reported in the wild.

Successful exploitation results in unauthenticated remote code execution on the affected server, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. Since no patch or mitigation is currently confirmed, affected installations remain at risk until an official fix is released.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable component if possible and monitor for unusual activity related to the CacheWarmer cookie. Avoid exposing the vulnerable service to untrusted networks. Do not rely on generic mitigations; wait for vendor-provided patches or official workarounds.