Mirasvit Full Page Cache Warmer for Magento 2 contains a PHP object injection flaw that allows attackers to supply a crafted serialized object in the CacheWarmer cookie. The vulnerability arises from an unrestricted call to PHP's unserialize() function coupled with vulnerable gadget chains in Magento and its dependencies. Exploitation yields arbitrary code execution on the web server, compromising confidentiality, integrity, and availability of the entire application.

The affected product is Mirasvit Full Page Cache Warmer for Magento 2. All versions released before 1.11.12 are vulnerable. Users who have not yet applied the 1.11.12 update are at risk.

The CVSS score of 9.3 highlights a high severity vulnerability. EPSS data is not available, but the flaw can be exploited without authentication by simply setting a malicious value in the CacheWarmer cookie, indicating a high likelihood of remote exploitation in a suitably configured environment. The vulnerability is not listed in the CISA KEV catalog, but the unrestricted unserialize() call combined with gadget chains provides a clear attack path for remote code execution.