Mirasvit Full Page Cache Warmer CVE-2026-45247 exploited to run code on online shops; fix available
Attackers are exploiting Mirasvit Full Page Cache Warmer versions before 1.11.12 on Magento and Adobe Commerce shops. Store operators should update the extension and have their developer check for signs of compromise.
If your family or business runs a Magento or Adobe Commerce shop, ask its developer to check for Mirasvit Full Page Cache Warmer, including bundled installations, and update it to 1.11.12 or later. Ask them to review server logs and check for malicious files as well. Shoppers have no extension on their own devices to update.
What’s happening
CVE-2026-45247 affects Mirasvit Full Page Cache Warmer, an extension used by Magento and Adobe Commerce online shops. It mishandles untrusted data in a cookie, allowing an attacker to run code on the shop’s server without signing in. Versions before 1.11.12 are affected, including installations bundled with other Mirasvit packages. Mirasvit released the fix on 25 May, and Sansec disclosed the flaw the following day. Imperva reported attack attempts by 29 May; CISA added it to its exploited-vulnerability catalogue on 3 June. As at 3 November, the fix is available in 1.11.12 and later releases. Operators should also check for an earlier compromise. The reviewed sources do not establish how many shops were compromised, whether customer information was stolen, or whether attacks have ended.
- What
- Flaw
- Affects
- Mirasvit Full Page Cache Warmer for Magento 2
- Affected
- Mirasvit Full Page Cache Warmer for Magento 2 versions before 1.11.12
- Fixed in
- Mirasvit Full Page Cache Warmer for Magento 2 1.11.12
- Since
- 3 June 2026
- Closed
- 3 June 2026
Timeline
- CISA added
CISA added CVE-2026-45247 to its Known Exploited Vulnerabilities catalogue, with a 6 June remediation deadline for US federal civilian agencies.
- Wider attacks
Imperva reported exploitation attempts since disclosure, including requests intended to test whether attackers could run commands on vulnerable servers.
- Made public
Sansec published its advisory for CVE-2026-45247. It warned that the extension can also arrive bundled with other Mirasvit packages.
- New fixFixed
Mirasvit released Full Page Cache Warmer 1.11.12, fixing PHP object injection in session-cookie handling.
- UpdateNo fix yet
Sansec notified Mirasvit about the vulnerability.
- Update
Sansec discovered the flaw and deployed protection for its Sansec Shield customers.
Sources
- Full Page Cache Warmer for Magento 2 — What's NewMirasvit · 25 May 2026
- Critical vulnerability in Mirasvit Cache Warmer for MagentoSansec · 26 May 2026
- Imperva Customers Protected Against CVE-2026-45247 in Mirasvit Full Page Cache Warmer for MagentoImperva · 29 May 2026
- CVE-2026-45247 DetailNIST NVD · 26 May 2026
- Mirasvit Vulnerability Exploited to Execute Code on Magento ServersSecurityWeek · 4 June 2026