{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6222", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-17T22:31:51.523Z", "datePublished": "2025-07-18T05:23:56.741Z", "dateUpdated": "2026-04-08T16:45:59.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:59.769Z"}, "affected": [{"vendor": "WP Swings", "product": "WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7b5a1-b052-4390-8e08-f97aa9c16b29?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-refund-and-exchange/17810207#item-description__changelog"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguy\u1ec5n Kim Sang"}, {"lang": "en", "type": "finder", "value": "Ng\u00f4 Th\u00e1i An"}], "timeline": [{"time": "2025-06-18T15:23:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-18T14:46:32.666455Z", "id": "CVE-2025-6222", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:56:25.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-18T14:46:32.666455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:54:29.548Z"}}], "cna": {"title": "WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet <= 3.2.6 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "Nguy\u1ec5n Kim Sang"}, {"lang": "en", "type": "finder", "value": "Ng\u00f4 Th\u00e1i An"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "WP Swings", "product": "WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-18T15:23:20.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7b5a1-b052-4390-8e08-f97aa9c16b29?source=cve"}, {"url": "https://codecanyon.net/item/woocommerce-refund-and-exchange/17810207#item-description__changelog"}], "descriptions": [{"lang": "en", "value": "The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:59.769Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6222", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:59.769Z", "dateReserved": "2025-06-17T22:31:51.523Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-18T05:23:56.741Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El tema WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n 'ced_rnx_order_exchange_attach_files' en todas las versiones hasta la 3.2.6 incluida. Esto permite que atacantes no autenticados carguen archivos arbitrarios en el servidor del sitio web afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-6222", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-18T06:15:26.730", "references": [{"source": "security@wordfence.com", "url": "https://codecanyon.net/item/woocommerce-refund-and-exchange/17810207#item-description__changelog"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7b5a1-b052-4390-8e08-f97aa9c16b29?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:40:19.720754+00:00", "value": {"mitigation_remediation": ["Upgrade the WP Swings WooCommerce Refund And Exchange with RMA \u2013 Warranty Management, Refund Policy, Manage User Wallet plugin to the latest version (\u22653.2.7) where file type validation has been added.", "If an upgrade cannot be performed immediately, disable the ced_rnx_order_exchange_attach_files upload feature or restrict the upload form so that files are stored in a non\u2011executable directory.", "Deploy a web application firewall or use a WordPress security plugin to block arbitrary file uploads, permitting only safe file extensions (e.g., images).", "Ensure the WordPress user role that handles uploads has the least privileges necessary, typically limiting the ability to create executables."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw exists in the WP Swings WooCommerce Refund And Exchange with RMA \u2013 Warranty Management, Refund Policy, Manage User Wallet add\u2011on for WordPress. Versions 3.2.6 and earlier are vulnerable. Sites using any of those versions hosted on a standard WordPress installation are at risk.", "description_and_impact": "The vulnerability allows an unauthenticated attacker to upload files of any type because the function ced_rnx_order_exchange_attach_files does not validate the file\u2019s MIME type or extension. This flaw is classified as CWE-434. An attacker could place a PHP, .htaccess, or other executable file on the server and then execute it via the web server, giving full remote code execution on the WordPress site. The impact is a complete compromise of confidentiality, integrity, and availability for the affected website.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical vulnerability. The EPSS score of <1% reflects a low probability of exploitation in the current field. The flaw is not listed in the CISA KEV catalog, but the lack of authentication combined with the ability to upload arbitrary files makes it theoretically straightforward for an attacker to discover the upload endpoint and place malicious content. The attack is delivered over the network through an unauthenticated HTTP request, and the attacker could proceed to execute the uploaded file if the server treats it as executable."}}}}, "created": "2026-04-21T19:45:16.079704+00:00", "updated": "2026-04-21T19:45:16.079722+00:00", "vendors": []}