CVE-2025-6222

Published Jul 18, 2025

Last updated 16 hours ago

CVSS critical 9.8

Overview

Description
The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source
security@wordfence.com
NVD status
Received

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@wordfence.com
CWE-434

Social media

Hype score
Not currently trending

  1. [CVE-2025-6222: CRITICAL] Vulnerability alert: WooCommerce Refund And Exchange with RMA WordPress theme up to v3.2.6 allows unauthenticated attackers to upload files, risking remote code execution. #CyberSecurity#cve,CVE-2025-6222,#cybersecurity https://t.co/pYInKgNi0n https://t.

    @CveFindCom

    18 Jul 2025

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.