Security researchers at Sansec have uncovered a critical vulnerability in the popular Mirasvit Cache Warmer extension for Magento Open Source. The flaw allows unauthenticated remote code execution (RCE) through a specially crafted cookie on any storefront page.

The vulnerability, tracked as CVE-2026-45247 and rated 9.8 Critical, affects all Mirasvit Cache Warmer versions before 1.11.12.

𝗪𝗵𝘆 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝘀 👇
Third-party Magento extensions can significantly improve performance and functionality, but when left unpatched or poorly maintained, they may also introduce serious security risks, including:
🔸 Remote Code Execution (RCE)
🔸 SQL Injection
🔸 Cross-Site Scripting (XSS)
🔸 Malware & Backdoor Injections
🔸 Data Leaks

𝗪𝗵𝗮𝘁 𝘆𝗼𝘂 𝘀𝗵𝗼𝘂𝗹𝗱 𝗱𝗼 𝗶𝗺𝗺𝗲𝗱𝗶𝗮𝘁𝗲𝗹𝘆:
1️⃣ Check whether your Magento environment is running the Mirasvit Cache Warmer extension
2️⃣ Update to version 1.11.12 or later immediately
3️⃣ Review your logs for suspicious CacheWarmer cookie activity
4️⃣ Scan your environment for potential compromise or malicious PHP files

At Hosted Power, we strongly believe that high-performance Magento hosting should also mean enterprise-grade security. That’s why we continuously monitor infrastructure, support proactive patch management and help Magento merchants keep their environments secure, scalable and stable.

👉 Read the full Sansec advisory here:
https://lnkd.in/eF23As9a

Magento servers