An attacker with write access to the Magento cache backend can inject specially crafted PHP objects into the cache data. The TrueLayer Magento 2 Plugin’s Psr16CacheAdapter uses PHP’s native unserialize() function without restricting allowed classes. When untrusted data is retrieved, the unserialization process instantiates these objects, allowing the attacker to trigger gadget strings present in the application environment and ultimately execute arbitrary code.

TrueLayer Magento 2 Plugin, versions 2.4.0 through 2.4.2, running on Magento 2 e‑commerce platforms.

The CVSS base score of 7.5 indicates a high severity level. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have the ability to write to the cache infrastructure, either through local filesystem access or via a remotely accessible cache service such as Redis or Memcached. If these conditions are met, the attacker can inject malicious serialized payloads that are processed during cache retrieval, leading to arbitrary code execution. Therefore, the risk is significant for deployments where cache write permissions are not tightly constrained.