9.8 Critical

CVE-2025-6222 The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for…

Description

The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products and versions

Product	Affected versions	Fixed in
WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet 3.2	earliest → 3.2.6	No fix stated

Do you use WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet?

Track this CVE Watch WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet Check my SBOMs

www.cveye.io/en/cve/CVE-2025-6222

Timeline

Published July 18, 2025
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
codecanyon.net codecanyon.net

Track this CVE