Mirasvit Cache Warmer RCE: patch your Magento store today
A single crafted cookie can run arbitrary code on your server. If you use any Mirasvit extension, you may be exposed — even if you never installed Cache Warmer directly. I audit, upgrade and verify your store the same day.
Source: Sansec research, May 2026 — Mirasvit Cache Warmer object injection. Patched in version 1.11.12.
What is the vulnerability?
Mirasvit Cache Warmer — a popular full-page-cache warmer for Magento 2 and Adobe Commerce — processes a CacheWarmer cookie with PHP’s native unserialize() without restricting which classes may be instantiated. Because the cookie comes from the client, an attacker controls object instantiation. Combined with known Magento gadget chains, that escalates to remote code execution.
Mirasvit responded quickly and shipped a fix in Cache Warmer 1.11.12 (released 25 May 2026). A CVE has been requested but is not yet assigned. Updating is urgent.
You might be running it without knowing
Cache Warmer ships bundled inside several Mirasvit packages. So even if you never installed “Cache Warmer” on purpose, another Mirasvit extension may have pulled it in — which is exactly why ~6,000 stores are exposed.
How to tell if you’re affected
- You run any Mirasvit extension and your Cache Warmer version is below 1.11.12.
- Your access logs show storefront requests carrying a
CacheWarmercookie whose value contains the markerCacheWarmer:followed by a base64 string matching(Tz|Qz|YT)— a sign of attempted exploitation. - Not sure what you have installed? That uncertainty is the risk — I’ll check your
composer.lockand module list in minutes.
How I fix it — fast, today
Audit your stack
I check your installed Mirasvit packages and composer.lock for Cache Warmer — including bundled copies you didn’t install directly.
Upgrade to 1.11.12+
Patch Cache Warmer to the fixed release with a tested, zero-downtime deploy (maintenance window, compile, static deploy, cache flush).
Scan for exploitation
Grep access logs and the database for the exploit cookie marker and other indicators of compromise — to confirm whether anyone already tried.
Clean up if needed
If there are signs of compromise, I remove backdoors and harden the store — see my Magento malware removal service.
Verify & harden
Confirm the patch is live, re-test, and tighten the store with a full security audit so the next disclosure doesn’t catch you out.
Get patched today
Emergency Patch
- Audit Mirasvit packages & version
- Upgrade Cache Warmer to 1.11.12+
- Zero-downtime deploy + cache flush
- Quick log scan for the exploit cookie
- Confirmation the fix is live
Patch + Compromise Scan
- Everything in Emergency Patch
- Deep indicators-of-compromise scan
- Backdoor / webshell check & removal
- Security patch (APSB) gap review
- Hardening recommendations report
Both are fixed-fee and show hours at my standard $25/hr rate. Larger or multi-store estates: I’ll quote a sprint.
Frequently asked questions
What is the Mirasvit Cache Warmer vulnerability?
CacheWarmer cookie to unserialize() without restricting allowed classes, so an attacker can instantiate objects and — with Magento gadget chains — achieve unauthenticated remote code execution. It is fixed in Cache Warmer 1.11.12.I never installed Cache Warmer — am I still affected?
Is updating to 1.11.12 enough?
How do I know if I was already hacked?
CacheWarmer cookie whose value contains CacheWarmer: plus a base64 marker matching (Tz|Qz|YT), plus the usual signs — unexpected admin users, modified core files, or new PHP files in writable paths. My Patch + Compromise Scan tier covers this end to end.